How to find out if your email has been leaked

Leaked, hacked, breached: what each one means

People say “my email was hacked” for two different things. One is that someone got into your mailbox and can read your mail. That is rare and serious; the fix is to change your email password now and turn on two-step sign-in. The other, far more common, is that a company you gave your address to was broken into and its customer list escaped. Your mailbox is fine. Your address is simply on a list that shouldn’t exist.

That second kind is what “leaked” means, and it has happened to nearly everyone. What matters is what was taken alongside the address. Just the address: more spam. Address and password: anyone can try that pair at every other site you use. Address, password, phone and home address: enough to impersonate you convincingly.

How the check works

There is a public record of known break-ins, kept by a service called Have I Been Pwned, which collects the lists once they surface and publishes which companies, which dates and which kinds of data. The check is matching your address against that record.

You can do it on their website. Binit does it a quieter way: it downloads the list of breaches, which is identical for everybody, and matches your address against it on your phone. Your address is never in the request. Because Binit also knows which companies you have accounts with, from the receipts and welcome emails in your inbox, it can tell you something more useful than “your address appears in 14 breaches”: it tells you Copperfield Tickets was hacked in September 2021 and passwords were taken, and Nimbus Store in April 2023, and gives you a button to go and change each one.

What to do, in order

Change the password at the breached company. Even if you don’t care about that account, a working password for it is a password someone will try elsewhere.

Change it anywhere else you used the same one. This is the step people skip and the one that matters. Reused passwords are how one shop’s break-in becomes your bank.

Turn on two-step sign-in at anything important: email, bank, the account your phone is tied to. A stolen password alone then gets nobody in.

Check the password you use most. If it appears in any published list it’s already being tried everywhere. Binit’s check sends five scrambled characters and nothing else, so you can test it without handing it over.

Binit puts these in a list with the quickest wins first and gives the address a safety score out of 100, so you know whether you’re looking at ten minutes of fixes or none. It can watch other addresses too, an old one or a family member’s, and checking them sends nothing anywhere.

What not to do

Don’t type your real password into a website to see if it’s been leaked. Don’t pay a service to “remove you from the dark web”; once a list is out, nobody can recall it, and the useful work is all on your side. And don’t abandon the email address. A new address resets nothing except your contacts’ ability to reach you.