How to Check If Your Email Has Been Compromised (2026 Guide)

Last updated: November 2, 2026. By Veer. Facts checked against Have I Been Pwned and its FAQs, Mozilla Monitor, Gmail Help, Apple’s iPhone User Guide, Report Fraud and reporting by The Verge and 9to5Google. This is a researched guide, not a product test.

What does “compromised” actually mean for an email account?

An email account counts as compromised in one of two ways: the address (often with a password) leaked in a data breach at some other company, or someone has actually signed in to your inbox. The first is very common and usually fixable in minutes. The second is serious, because whoever controls your email can reset the passwords on almost everything else you own.

It helps to keep the two apart, because they need different checks:

Most people only ever do the first check. The third one is the one that matters most.

How to check if your email has been compromised in a data breach

The quickest way to check if your email has been compromised in a breach is to type it into Have I Been Pwned (HIBP). It’s free, needs no account and shows every loaded breach your address appears in, with the date and the kinds of data taken (passwords, phone numbers, addresses and so on).

Here’s how to do it:

1. Go to haveibeenpwned.com and enter your email address.
2. Read the list of breaches. Each entry says what was exposed, for example “Email addresses, Passwords”.
3. Note any breach that included passwords. Those are the ones to act on first.
4. Click Notify Me to get an email if your address shows up in a future breach. HIBP only sends alerts to the address being watched, so nobody can monitor your email without your say-so (HIBP FAQs).

A few things worth knowing about the results:

• “Sensitive” breaches are hidden from public search. HIBP lists 90 of them, such as Ashley Madison. You only see them after you verify you own the address by signing in to the HIBP dashboard (HIBP FAQs).
• A clean result isn’t a clean bill of health. HIBP itself says it holds “but a small subset” of all breached records, and many breaches are never made public.
• Recent breaches may not be there yet. For example, the Capcom and Citizens Bank incidents we covered in October were not in HIBP’s public breach list when we checked on November 2, 2026. The newest additions were from late October.

Mozilla Monitor is a good second opinion with a friendlier walkthrough. Mozilla says its free tier lets you monitor 5 email addresses and guides you through fixing each breach. Mozilla’s paid Monitor Plus data-broker removal service closed on December 17, 2025, but the free breach alerts carry on (CyberInsider).

Has my password been leaked?

To check if a password has leaked, use the password checkup built into the place you store it, not a random website. Google Password Manager, Apple’s Passwords app, Microsoft Edge and dedicated password managers all compare your saved passwords against known breach lists without sending them in plain text.

• Google: open Password Checkup while signed in. It flags compromised, reused and weak passwords saved in Google Password Manager.
• iPhone, iPad and Mac: open the Passwords app and look at Security. Apple’s guide calls this changing weak or compromised passwords.
• Password managers: 1Password, Bitwarden and Proton Pass each have a breach or “exposed passwords” report. We compare them in Bitwarden vs 1Password vs Proton Pass.
• One password at a time: HIBP’s Pwned Passwords checks a single password. HIBP says the password is anonymized before it’s sent, and no password is stored next to an email address.

If any password shows up as leaked, change it on every site where you used it. Reuse is the real danger: attackers take leaked email-and-password pairs and try them on banks, shops and email providers, a technique called credential stuffing.

How to tell if someone is actually in your email

To tell if someone is actually in your email, check your provider’s sign-in history for devices, locations or apps you don’t recognize, then look for changes you didn’t make, especially forwarding rules. Attackers who get in quietly often set up forwarding so they keep reading your mail after you change the password.

Gmail

In Gmail on a computer, scroll to the bottom right of your inbox and click Details. Google says this “Activity on this account” page shows the last 10 IP addresses and access types (browser, phone, POP or IMAP) that used your account. Then check:

• Recent security events and your devices in your Google Account.
• Gmail Settings > See all settings > Forwarding and POP/IMAP and Filters and Blocked Addresses for rules you didn’t create.
• Third-party apps with account access for anything you don’t remember approving.

Google notes that a phone on mobile data can show a location far from where you are. A carrier name that matches yours isn’t unusual.

Outlook, Hotmail and Microsoft accounts

Sign in to your Microsoft account and open the Recent activity page. It lists recent sign-ins with location and device, and lets you mark one as “This wasn’t me”, which takes you to secure the account. In Outlook settings, check Mail > Forwarding and Rules too.

iCloud Mail and Apple Account

Apple doesn’t show an IP-by-IP history. Instead, check the device list in Settings > [your name] on iPhone, or at account.apple.com. Remove any device you don’t own, and check iCloud Mail settings at iCloud.com for forwarding you didn’t set up.

Warning signs in any inbox

• Password reset emails you didn’t request, especially from your bank or email provider.
• Sent messages you didn’t write, or friends saying you emailed them a strange link.
• Read messages you haven’t opened, or emails missing from your inbox.
• Security alerts about a “new sign-in” from a device you don’t own.

If your phone is acting strangely too, run through how to tell if your phone is hacked.

What to do if your email has been compromised

If your email has been compromised, secure the inbox first, then the accounts that depend on it. Do it from a device you trust, in this order:

1. Change the email password to a new, unique one. Use a password manager to generate it.
2. Sign out every other session. Gmail and Microsoft both offer this from their security pages after a password change.
3. Turn on stronger sign-in. A passkey or an authenticator app beats SMS codes, which can be stolen through SIM swaps (see Is SMS 2FA safe?).
4. Delete forwarding rules, filters and app connections you didn’t create.
5. Check your recovery phone number and backup email. Attackers often change these to lock you out later.
6. Change passwords on accounts that reset through this email, starting with banking, shopping, cloud storage and social media.
7. Warn your contacts if spam went out from your address, so they don’t click anything.

If money or identity documents were involved, report it. In the US, use the FTC’s IdentityTheft.gov, and consider a free credit freeze at Equifax, Experian and TransUnion. In England, Wales and Northern Ireland, Report Fraud replaced Action Fraud on December 4, 2025 (online or 0300 123 2040). In Scotland, call Police Scotland on 101.

Which free tools still work in 2026?

The main free tools for checking a leaked email in 2026 are Have I Been Pwned, Mozilla Monitor and the password checkups built into Google, Apple and password managers. Google’s own dark web report is gone: Google stopped scanning on January 15, 2026 and removed the report and its data on February 16, 2026, saying feedback showed it “did not provide helpful next steps” (The Verge).

Be careful with “free scan” pop-ups and ads that ask for your email plus your password. No legitimate breach checker needs your email password.

Our verdict

Check your email on Have I Been Pwned today, turn on Notify Me, and run your password manager’s breach report. That covers leaks. Then spend two minutes on your provider’s sign-in history and forwarding settings, because that’s the only way to know whether someone is actually reading your mail. If you find a breach with passwords, assume any reused password is burned and change it. If you want fewer leaks in the first place, cut down the personal data floating around with our guide to removing your personal info from the internet.

FAQ

How do I know if my email has been hacked or just leaked?

A leak means your address appeared in another company’s breach; you’ll see it on Have I Been Pwned. A hack means someone signed in to your inbox; you’ll see it as unfamiliar sign-ins, forwarding rules or sent mail in your provider’s activity pages.

Is Have I Been Pwned safe to use?

Yes, it’s widely used by individuals and security teams. HIBP says searches aren’t logged, it never shows passwords, and Pwned Passwords checks are anonymized before they leave your device.

What should I do if my email shows up in a data breach?

Change the password for the breached site and anywhere you reused it, then turn on a passkey or app-based two-step verification. If the breach included financial or identity data, watch your accounts and consider a credit freeze in the US.

My email wasn’t found. Does that mean I’m safe?

Not necessarily. HIBP says it holds only a small subset of breached data, and many breaches are never published, so keep using unique passwords and turn on alerts anyway.

Does Google still have a dark web report?

No. Google stopped scanning on January 15, 2026 and removed the dark web report on February 16, 2026. Google now points people to Security Checkup and Password Checkup instead.

Can I see who logged into my Gmail?

Yes. Click Details at the bottom right of Gmail on a computer to see the last 10 IP addresses and access types, and check Recent security events in your Google Account.

Sources

• Have I Been Pwned: Homepage and breach totals (checked November 2, 2026), FAQs, Pwned Passwords
• Mozilla: Mozilla Monitor, How it works
• Google: Gmail Help, Last account activity, Password Checkup
• Apple: iPhone User Guide, Passwords
• Microsoft: Recent activity
• Report Fraud: Report Fraud service goes live (December 4, 2025)
• FTC: IdentityTheft.gov
• The Verge: Google’s turning off its dark web monitoring service
• 9to5Google: Google’s short-lived ‘Dark web report’ tool shuts down this week (January 12, 2026)
• CyberInsider: Mozilla to retire Monitor Plus (November 21, 2025)