--- title: "Hear it first when your addresses leak · Wi24rd" description: "Get an email when an address on your domain turns up in a new leak. Have I Been Pwned is free for small domains – step by step, about 10 minutes." url: "https://wi24rd.com/en/security-tips/leaked-passwords/" lang: "en" alternates: da: "https://wi24rd.com/sikkerhedstips/leaked-passwords/" en: "https://wi24rd.com/en/security-tips/leaked-passwords/" --- Security tip 10 · Leaked passwords # Hear it first when your addresses leak. When a web shop or a forum is hacked, the customers’ email addresses and passwords end up online. Have I Been Pwned tells you when an address on your domain turns up in a new leak – free for small domains. Last checked 1 November 2026 [Go to the steps](https://wi24rd.com/en/security-tips/leaked-passwords/#trin) [When the email arrives](https://wi24rd.com/en/security-tips/leaked-passwords/#naar) Short answer Verify your domain with Have I Been Pwned (a DNS record or a file on the site), and turn on domain monitoring. You then get an email when an address on your domain appears in a breach – and can change the password and enable two-factor before anyone tries it. Time: ~15 minCost: free for up to 10 breached addressesLevel: no IT background needed Time ~10 min per domain Price Free up to 10 leaked addresses Covers The whole domain every address on it Needs Access to DNS or to admin@ Why ## It is not your fault. But it is your problem. Many people use the same password in several places. When a service is hacked, robots try the leaked email and password combinations on email, banking, Microsoft 365 and everything else – it is called _credential stuffing_, and it runs automatically around the clock. Have I Been Pwned is a free service that collects publicly known leaks – today over 17 billion addresses from more than a thousand leaks. Authorities in many countries use it to warn victims. It never shows the passwords, only that the address was included. _How it works: A service you use is hacked. The leak is loaded into Have I Been Pwned. You get an email listing which addresses are in it. You change the password before anyone tries it._ 1. **Leak**a service is hacked 2. **HIBP**the leak is loaded 3. **Email to you**which addresses 4. **You change**before anyone tries Step by step · Have I Been Pwned ## Six steps, about 10 minutes. 1. ### Check your own address Enter your email address on [haveibeenpwned.com](https://haveibeenpwned.com/). You see at once which known leaks it has been in. No account needed. 2. ### Sign in to the dashboard Choose **Dashboard** and sign in with a link by email or with a passkey. This is where domains are added. 3. ### Add the domain Under **Domain Search → Add domain**, enter the domain and choose how to prove it is yours. Each domain – subdomains too – must be verified separately. 4. ### Prove it is yours There are four ways: a **TXT record in DNS**, a meta tag on the home page, a small HTML file on the server or an email to a standard address such as `admin@` or `postmaster@`. If the domain is in Cloudflare, the TXT record is fastest: it is in place within minutes. 5. ### See what has already leaked Once the domain is verified, you can see every address on it that has been in a known leak – and which leaks. From now on you get an email every time a new leak contains one of your addresses. 6. ### Know the free limit Domains with up to 10 leaked addresses can be monitored for free. If you have more, a subscription is needed; the smallest covers up to 25 leaked addresses and costs around 4–5 dollars a month. Add the domain first – then the dashboard shows how large it is. If you do not have a domain, you can still get notified for your own address: choose **Notify me** on the home page. When the email arrives ## Four things, the same day. 1. ### Change the password At the service that was hacked – and everywhere else the same password has been used. 2. ### Switch on passkeys or two-step Then a leaked password is not enough to get in. Start with the email account – it can reset all the others. 3. ### Tell the person If it is an employee’s address, say so directly and without blame. The leak happened somewhere else. 4. ### Watch for phishing Leaked addresses get more fake emails that use details from the leak. Give a warning about it. Honest about the limits ## What the service does not do. - **Only known leaks.** A leak that never becomes public is not included. - **It comes afterwards.** Weeks can pass from a hack until the leak turns up. - **It does not protect.** It tells. Passkeys and different passwords are what protect – a password manager makes it easy, and many of them check against the same database themselves. **About this tip** Prices and steps were checked on [haveibeenpwned.com](https://haveibeenpwned.com/Subscription) and in [the service’s own guide](https://support.haveibeenpwned.com/hc/en-au/articles/15543011690767-How-do-I-verify-my-domain) on 1 November 2026. Wi24rd has no financial interest in Have I Been Pwned. The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services. [All security tips](https://wi24rd.com/en/security-tips/) [See the figures live](https://wi24rd.com/en/right-now/) [Back to Security tips](https://wi24rd.com/en/security-tips/) [To the top](https://wi24rd.com/en/security-tips/leaked-passwords/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/) [The site’s own defences](https://wi24rd.com/en/security/)