Data Breaches and Password Reuse: What to Do When Your Password Is Exposed
Last updated: September 2026
Every generator on this site tells you not to reuse a password. Here's the specific reason why, what happens when a service you use gets breached, and how to actually find out whether it's already happened to you.
Why password reuse is the real risk
When a service is breached, the attacker usually walks away with a list of email-and-password pairs. The next step, called credential stuffing, is automated: the attacker takes that list and tries the same pairs against every other major site — banking, email, shopping, social media — betting that a meaningful percentage of people reused the same password. It works often enough that it's one of the most common ways accounts get taken over, and it has nothing to do with how strong your password was. A 20-character random password reused on two sites is only as safe as the weaker of those two sites.
Why NIST recommends screening against breach lists
NIST's current digital identity guidelines (SP 800-63B, finalized in its latest revision in 2025) require that new or changed passwords be checked against lists of known-compromised and commonly-used passwords before they're accepted. The reasoning is direct: a password that's already circulating in breach data is a bad password no matter how it scores on length or character variety, because attackers are already trying it.
How to check if you've already been exposed
The standard free tool for this is Have I Been Pwned, run by security researcher Troy Hunt since 2013 and widely used by security teams, journalists, and government agencies. You can search an email address to see which known breaches it's appeared in, or use the site's Pwned Passwords tool to check whether a specific password shows up in breach data — the same underlying dataset NIST's screening recommendation refers to. Neither check requires creating an account, and Pwned Passwords is built so your actual password is never transmitted in full.
What to do if you find you've been exposed
Change the password on the breached account first
Use the generator to create a new, unique password for that specific account.
Change it everywhere else you reused it
If you used the same or a similar password anywhere else, treat every one of those accounts as at risk too, not just the one that was actually breached.
Turn on two-factor authentication where it's offered
A second factor means a leaked password alone isn't enough to get into the account.
Consider a password manager if this keeps happening
The real fix for reuse is never having to remember or reuse a password in the first place. See our honest breakdown of when that's worth setting up.
Frequently asked questions
What is credential stuffing?
Automated attempts to log into other accounts using email-and-password pairs stolen from a different breach, betting that the same password was reused. It's one of the most common ways accounts get taken over, and it works regardless of how strong the original password was.
Is it safe to check my password on a breach-checking site?
Have I Been Pwned's Pwned Passwords tool is built specifically so your password isn't transmitted in full during the check. If you'd rather not type a real password anywhere, checking a similar dummy password with the same structure still tells you whether that pattern is known to be compromised.
What should I do first if my email shows up in a breach?
Change the password on the breached account, then change it anywhere else you reused it. Enable two-factor authentication wherever the service offers it.