Your password was leaked: what to do next
By the FreeAllTool team · Updated October 28, 2026
You get an alert that your password appeared in a data breach, or you notice a login you do not recognise. Acting quickly limits the damage. Work through these steps in order.
1. Change the affected password
Log in to the account through the official app or website, not through a link in an email, and change the password to a new, long, random one. Our password generator can create one instantly. If you cannot log in, use the service’s official account recovery process.
2. Change it everywhere you reused it
Criminals take leaked email and password pairs and try them on many other sites, a technique called credential stuffing. Any account where you used the same or a similar password is now at risk. Give each one its own unique password.
3. Secure your email first
If your email account was affected, treat it as top priority. Whoever controls your email can reset passwords for your other accounts. Change its password, check that the recovery phone number and backup email are yours, and remove any forwarding rules you did not create.
4. Turn on two-step verification
Enable it on email, banking, social media and shopping accounts. Even if a password leaks again, the attacker will need your phone or security key to get in.
5. Sign out of other sessions
Many services show where your account is logged in and let you sign out of all other devices. Use this to remove anyone who may already be inside.
6. Check for unusual activity
Look at recent orders, sent emails, social media posts, bank transactions and changes to your profile. Contact your bank immediately about any payment you did not make.
7. Watch out for follow-up scams
After a breach, criminals often send phishing messages that mention the breach to seem believable. Be extra careful with emails or calls asking you to “verify” your account.
Prevent the next one
You cannot stop companies from being breached, but you can make sure a leak at one site affects only that site. A password manager and a unique password for every account are the most effective long-term fix.