Security tip 10 · Leaked passwords
Hear it first when your addresses leak.
When a web shop or a forum is hacked, the customers’ email addresses and passwords end up online. Have I Been Pwned tells you when an address on your domain turns up in a new leak – free for small domains.
Last checked 1 November 2026
Short answer
Verify your domain with Have I Been Pwned (a DNS record or a file on the site), and turn on domain monitoring. You then get an email when an address on your domain appears in a breach – and can change the password and enable two-factor before anyone tries it.
- Time
- ~10 min per domain
- Price
- Free up to 10 leaked addresses
- Covers
- The whole domain every address on it
- Needs
- Access to DNS or to admin@
Why
It is not your fault. But it is your problem.
Many people use the same password in several places. When a service is hacked, robots try the leaked email and password combinations on email, banking, Microsoft 365 and everything else – it is called credential stuffing, and it runs automatically around the clock.
Have I Been Pwned is a free service that collects publicly known leaks – today over 17 billion addresses from more than a thousand leaks. Authorities in many countries use it to warn victims. It never shows the passwords, only that the address was included.
- Leaka service is hacked
- HIBPthe leak is loaded
- Email to youwhich addresses
- You changebefore anyone tries
Step by step · Have I Been Pwned
Six steps, about 10 minutes.
Check your own address
Enter your email address on haveibeenpwned.com. You see at once which known leaks it has been in. No account needed.
Sign in to the dashboard
Choose Dashboard and sign in with a link by email or with a passkey. This is where domains are added.
Add the domain
Under Domain Search → Add domain, enter the domain and choose how to prove it is yours. Each domain – subdomains too – must be verified separately.
Prove it is yours
There are four ways: a TXT record in DNS, a meta tag on the home page, a small HTML file on the server or an email to a standard address such as
admin@orpostmaster@. If the domain is in Cloudflare, the TXT record is fastest: it is in place within minutes.See what has already leaked
Once the domain is verified, you can see every address on it that has been in a known leak – and which leaks. From now on you get an email every time a new leak contains one of your addresses.
Know the free limit
Domains with up to 10 leaked addresses can be monitored for free. If you have more, a subscription is needed; the smallest covers up to 25 leaked addresses and costs around 4–5 dollars a month. Add the domain first – then the dashboard shows how large it is.
If you do not have a domain, you can still get notified for your own address: choose Notify me on the home page.
When the email arrives
Four things, the same day.
Change the password
At the service that was hacked – and everywhere else the same password has been used.
Switch on passkeys or two-step
Then a leaked password is not enough to get in. Start with the email account – it can reset all the others.
Tell the person
If it is an employee’s address, say so directly and without blame. The leak happened somewhere else.
Watch for phishing
Leaked addresses get more fake emails that use details from the leak. Give a warning about it.
Honest about the limits
What the service does not do.
- Only known leaks. A leak that never becomes public is not included.
- It comes afterwards. Weeks can pass from a hack until the leak turns up.
- It does not protect. It tells. Passkeys and different passwords are what protect – a password manager makes it easy, and many of them check against the same database themselves.
About this tip
Prices and steps were checked on haveibeenpwned.com and in the service’s own guide on 1 November 2026. Wi24rd has no financial interest in Have I Been Pwned.
The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services.
Missing a tip?
Write what you would like explained. The next security tip could be yours.