Has my password leaked? How to check, and what to do

MaciPhoneAndroidWindowsUpdated

Your phone or computer can probably tell you already. Apple's Passwords app and Google Password Manager both compare the passwords you've saved with passwords known to have appeared in data leaks, and flag the ones that match. If one is flagged, change it on that site and anywhere else you used it, then turn on 2-step verification.

Quick answer

Open the Passwords app on your iPhone or Mac and choose Security, or run Google's Password Checkup in Chrome or at passwords.google.com. Both flag saved passwords that have appeared in known leaks. Change any flagged password on that site and on every other account where you reused it, and turn on 2-step verification.

How do I check on an iPhone or Mac?

Use the Passwords app. Apple says your iPhone or Mac can securely monitor your passwords and alert you if they appear in known data leaks.

On an iPhone:

  1. Open the Passwords app.
  2. Tap Security. If an account has a weak or compromised password, a message explains the problem.
  3. Tap an account, then tap Change Password and change it on the website or in the app.

On a Mac:

  1. Open the Passwords app.
  2. Click Security in the sidebar.
  3. Click an account, then click Change Password and change it on the website or in the app.

The checking can be switched off, so make sure it's on. On an iPhone, go to Settings > Apps > Passwords and turn on Detect Compromised Passwords. On a Mac, open Passwords and choose Passwords > Settings, then select Detect Compromised Passwords.

How do I check with Google Password Manager?

Run Password Checkup. Google says it checks the passwords saved in your Google Account and sorts them into three groups: exposed, weak, and used in more than one account.

  • Chrome on a computer: at the top right, select More > Passwords and autofill > Google Password Manager, then select Checkup on the left.
  • Chrome on Android: tap More > Settings > Autofill and passwords > Google Password Manager > Checkup.
  • Any other browser: go to passwords.google.com, select Go to Password Checkup, then Check passwords. You may need to sign in.

Google says compromised username and password combinations are unsafe because they've been published online, and recommends changing them as soon as you can.

Does the NCSC suggest any other way to check?

The UK's National Cyber Security Centre (NCSC) says that to check whether your details have appeared in public data breaches, there are online tools you can use, and it names haveibeenpwned.com as one. It adds that similar services are often included in antivirus or password manager tools you may already have.

My password has leaked. What should I do?

Change it, and then change it everywhere you reused it. The NCSC says criminals take passwords stolen in a breach and try them on other accounts, a technique called credential stuffing, which works because many people use the same password in several places. It calls data breaches the most common way passwords are stolen.

  1. Change the leaked password on that site. Go there by typing the address or using its app, not through a link in a message.
  2. Change it on every other account that used the same password. The NCSC is clear that both steps matter.
  3. Use a password manager. The NCSC says one lets you have a unique password for each service, because you don't have to remember them. It can create strong passwords for you, and it helps against phishing because the password only fills in on the correct website. The NCSC says it's safe to let your browser or device save your passwords on your own devices, and that all the major browsers, such as Chrome, Edge and Safari, offer to create or save them.
  4. Turn on 2-step verification on important accounts, starting with email, then banking, social media and shopping. The NCSC says it helps keep criminals out "even if they know your passwords".

If you can't get into an account, or you see changed security settings or logins you don't recognise, follow someone else signed into your account.

Did PHP2Shell leak my passwords?

There's no official report saying so. PHP2Shell is two critical flaws in PHP, the language many websites run on, fixed by the PHP project on 21 October 2026. The NCSC says they could let attackers run commands on web servers running PHP. A flaw on a server isn't the same as a breach, which the NCSC describes as information being stolen or accessed without authorisation. As of 23 October 2026, no official advisory lists affected companies or customers. Our guide to your personal data and PHP2Shell covers how you'd be told.

Where Failshot fits

Failshot deals with a different problem from a leaked online password. Your Mac password is the first layer on your Mac. Failshot is second layer device security, the layer after your password.

Failshot is for the moment someone sits down at your Mac and unlocks it.

With Failshot on, it takes photos of whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, a wrong Failshot PIN or answer, or its camera access being switched off while it's on. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot is a free download for Mac from failshot.app, on macOS 14 or later, and free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel. iPhone, Android and Windows versions are coming soon.

More questions

Does a flagged password mean someone has been in my account?

Not on its own. The flag means the password appeared in a known leak. Change it anyway, then check the account for the signs the NCSC lists: being unable to log in, changed security settings, messages you didn't send, or logins from strange places or at unusual times.

Will Google tell me if one of my passwords leaks?

Google says it can notify you when it finds your saved passwords online, and that these password alerts can be turned on or off at passwords.google.com under Settings. If you get such a notice, Google says to go directly to Password Checkup to make sure it's authentic.

Can I ignore a warning for an old account?

Apple lets you hide a recommendation you can't act on: in Passwords, choose Security, select the account, then Hide. If the site no longer exists, Apple says you can remove that account from your passwords altogether.

Is a passkey better than a password?

The NCSC says that, if available, you could use a passkey instead when you change a password. Apple says that if a site or app lets you use a passkey or Sign in with Apple, you can switch to it when you change a flagged password.

An email says my password was in a breach. Is it real?

It may not be. The NCSC warns that criminals send messages pretending to be from organisations that have had a breach. Don't use the links. Check through the Passwords app, Password Checkup or the organisation's official website instead.

Sources