Find Out If Your Passwords Have Been Leaked 📚

Every year companies get hacked and their user data, including passwords, spills onto the internet. If you have had an email address for more than a year or two, it is almost certainly in at least one of these breaches, usually several. Most people have no idea.

The danger is not one leaked password on its own. It is that most people reuse the same password across lots of accounts. So one old leak from a site you forgot about can be the key someone uses to walk into your email, and from there, everything else. The good news: finding out and fixing it is free and fast.

• ChatGPT with web search on (or use Work) to look things up and build your plan.
• A password manager, or your browser's built-in password checker, to see which of your own passwords are compromised and to store the new ones.

Both are free.

Start by finding out which breaches your email address has been caught in. Turn on web search in ChatGPT (or use Work) and run this:

Check which known data breaches my email has been in (use Have I Been Pwned as your source). For each one, tell me: the company, the year it happened, and exactly what data leaked (passwords, addresses, phone numbers, payment details). Then summarise in plain English what that means for me. My email is [EMAIL].

Then run your password manager's checkup, or Google Password Checkup, or Apple's built-in checker, to see which of your actual passwords are compromised. No AI ever needs to see those.

Now figure out which doors are actually wide open, so you fix the scariest ones first. Stay in the same chat:

Based on the breaches I'm in and the accounts that matter to me, tell me which of my accounts are most at risk right now, ranked from most dangerous to least. Factor in: anywhere I've reused a password, anything with money or my identity attached (email, bank, main logins), and anywhere one leaked password could unlock even more. Give me the exact order to fix them in.

What happens next: ChatGPT gives you a prioritized list. This matters because you do not need to panic-change 50 passwords at once, you need to fix the few that could do real damage, in the right order.

Have ChatGPT build your fix-it plan and generate strong new passwords for you. Then you make the changes yourself.

Build me a step-by-step lock-down plan. Go through my at-risk accounts in the order you ranked them. For each one: give me a strong unique password I can copy, the exact steps to change the password on that service, and the exact steps to turn on two-factor authentication. Tell me where to store the new passwords. I will make every change myself, do not ask me for any login details.

Never let an AI log into your accounts. It makes the plan, you make the changes. Save every new password straight into your password manager as you go.

This topic attracts scams, because "see your leaked passwords" is irresistible bait.

• Never type a password into a "breach checker". A reputable checker only ever needs your email address. If a site asks for your actual password to "see if it's been leaked", close it immediately. That is how they steal it.
• Stick to the safe tools. Have I Been Pwned (haveibeenpwned.com) for breach checking, and your password manager, Google Password Checkup, or Apple's built-in checker for your own compromised passwords. That is the whole safe toolkit.
• When in doubt, ask. Paste the site or message into ChatGPT and ask "is this a safe, reputable tool, or a scam?" before you enter anything.

• Use a password manager. It creates a different strong password for every account and remembers them all, so a leak from one site can never unlock another. This single change fixes the root problem.
• Turn on two-factor everywhere that matters. Email, bank, and main logins first. An authenticator app beats text-message codes.
• Use passkeys when offered. They use your phone or face instead of a password. There is nothing to leak.
• Never reuse a password again. Reuse is what turns one small leak into a disaster.
• Re-check every few months. New breaches happen constantly. Re-run the breach check and your password manager's checkup. Two minutes, and you stay ahead of it.

1. Run the breach check on your email.
2. Run your password manager or Google Password Checkup to see compromised passwords.
3. Have ChatGPT rank your risk and build the fix plan.
4. Change your email password and turn on 2FA first, then work down the list.
5. Set up a password manager so you never reuse a password again.

Fifteen minutes today beats a hijacked account tomorrow.