Have I Been Pwned (haveibeenpwned.com) is a free, widely trusted service that tracks known data breaches and lets anyone check whether their email address or password has appeared in one. It's run by a well-known independent security researcher and used by security teams worldwide — not itself a data collector with any hidden angle.
Typing an email address into the site's search checks it against every breach in its database and lists which ones it appeared in, along with what data each breach exposed (passwords, phone numbers, addresses, and so on) — useful context for deciding which accounts need an urgent password change.
The site also offers a separate password-checking tool. Typed passwords are never sent to the server in plain form — the check works through k-anonymity, sending only a partial hash of the password, so the full password never leaves the browser. Worth checking any password still in active use, especially an old one that might be reused elsewhere.
A match doesn't mean an account is currently compromised — it means the password was exposed in a past breach and should be treated as burned. Change the password on that specific account immediately, and check whether the same password was reused anywhere else — if so, change those too, and this is exactly the moment a password manager (covered earlier) turns into an unavoidable rather than optional step.
Set up notifications, don't just check once
Consider setting up the site's free notification service for an email address — it sends an alert automatically the next time that address turns up in a newly discovered breach, rather than relying on remembering to check manually.
