To find out whether your passwords have been exposed in a breach, use a trusted service that checks hashed versions of your credentials without sending the plain text password over the internet.
Use a public breach lookup service
Websites such as Have I Been Pwned let you enter an email address or a password. When you type a password, the site hashes it locally, sends only the first five characters of the SHA‑1 hash, and receives a list of matching suffixes. Your browser then completes the comparison, so the server never sees the full password.
Leverage built‑in password‑manager scans
Most modern password managers (e.g., 1Password, Bitwarden, LastPass) include a background breach‑monitoring feature. They periodically hash the passwords stored in your vault and compare the hashes against up‑to‑date breach feeds. If a match occurs, the manager flags the entry and suggests a change.
Check email addresses against breach archives
Enter your primary email address on a breach‑lookup site. The service searches compiled lists from public disclosures and dark‑web dumps. It will tell you which services have reported your address, letting you prioritize which accounts to secure.
What to do after a match
- Change the compromised password immediately.
- Enable two‑factor authentication on the affected account.
- Ensure the new password is unique and strong; consider a passphrase or a random generator.
- Update any other accounts where you reused the same password.
Why k‑anonymity protects your privacy
The k‑anonymity method groups many different passwords under the same hash prefix. Because the server returns dozens or hundreds of possible suffixes, it cannot determine which exact password you queried. This approach balances useful breach information with strong privacy guarantees.
Additional tips for ongoing protection
- Use a dedicated password manager to store all credentials securely.
- Regularly review breach notifications from services you use.
- Adopt a password‑less login method (e.g., security keys) where possible.