Free guide · no signup to read
Your password was in a breach. Here's exactly what to do.
The leaked login is rarely the real danger. The danger is reuse, the same password sitting on your bank, your email, your everything. So the job for the next hour isn't "fix one account," it's find every account with that password and shut the door in the right order. Here's the checklist we'd hand a friend.
The checklist · in order
Confirm it, then hunt down every place you reused that password.
Check your email at haveibeenpwned.com. It's the standard free tool, and it's safe: only a partial hash of your address is sent, never your password. While you're there, turn on "Notify me" so the next breach finds you instead of the other way round.
Now the mindset shift: attackers don't stop at the site that leaked. They run credential stuffing, feeding your email + password pair into hundreds of other sites automatically. Every account sharing that password is now a target. Make a quick list of them before you start.
Change the breached password first, long, random, used nowhere else.
Reset the leaked account now. Length beats complexity: a long passphrase or a generated 16+ character password is the target, not "P@ssw0rd!" with a new symbol.
And never reuse it. A password is only as safe as the least-secure site you ever put it on.
Change every other account that shared that password.
This is the step almost everyone skips, and it's the one that actually protects you. Work the list from step 1, email and bank first, because those are the recovery hubs an attacker uses to take everything else.
This is also where it gets brutal. Reused one password across 40 sites? That's 40 manual resets, one login flow at a time.
Turn on two-factor, and skip SMS where you can.
Add 2FA to the breached account and your critical ones. Prefer an authenticator app (or a passkey where the site offers one) over text-message codes, SMS can be hijacked with a SIM swap. Where passkeys are available, they sidestep the stolen-password problem entirely.
If a site only offers SMS, use it anyway. Any second factor beats none.
Check for a break-in you haven't noticed yet.
Look at recent activity. In Gmail, click "Last account activity" at the bottom of your inbox; most services have a "where you're signed in" page. See a device or location that isn't you? Sign out of all sessions, then change the password again so the intruder's copy is dead.
Watch the money, and freeze your credit if it's serious.
Skim bank and card statements for charges you don't recognise. If the breach exposed financial or identity data (card numbers, SSN), you can place a free fraud alert and a free credit freeze with the three bureaus. A freeze blocks new credit checks entirely, it's the single strongest move, and you lift it temporarily when you actually need credit.
Make sure this is never an hour of your life again.
The breach only hurt because a password was reused. Move every account to a unique, generated password (a password manager does this for you), and the next leak is contained to exactly one login instead of forty.
That's the whole game: unique passwords shrink the blast radius. The manual part, actually resetting them all when a breach hits, is the part almost nobody has automated (Apple's starting to, on Apple devices only). Yet.
Wait, isn't changing passwords all the time bad advice now?
Yes, and that confusion is worth clearing up. In 2025, NIST, the US standards body, finalised guidance that says organisations should not force people to rotate passwords on a schedule. The reason: when you make someone change every 90 days, they just append a "2" and call it done, which helps no one.
But the same guidance is just as explicit: change a password immediately when there's evidence it's been compromised. Rotation for no reason is theatre. Rotation because your password is sitting in a breach is exactly the thing the experts agree you should do. This checklist is that, the right rotation, at the right moment.
Why we made this
Rekey helps you do steps 1-3.
You just read the ugly part, finding every reused login and resetting them one at a time. That's the job Rekey is being built to do: it watches for breaches and, the moment one hits, takes you to the change page for each affected password and confirms the new one by signing in before the old one is dropped. No lockouts, by design.
It's a browser extension, in development. If "a password manager that fixes the breach, not just flags it" sounds like something you'd have wanted an hour ago, get on the early-access list.
Passwords stay on your device. No server. No database. Open source.
Straight answers
Is Have I Been Pwned safe to use?
Yes. It checks your email address against known breaches and only ever receives a partial hash of it, never your password. It's the standard free breach-checking tool, run by security researcher Troy Hunt.
Do I really have to change passwords on other sites too?
That's the most important step. Attackers automate credential stuffing, trying your leaked email and password on hundreds of other sites. Any account using that same password is exposed until you change it.
Should I use SMS codes for two-factor?
Use them if that's all a site offers, 2FA over SMS still beats no 2FA. But prefer an authenticator app or a passkey where available, because SMS codes can be intercepted through SIM-swapping.
Is a credit freeze the same as a fraud alert?
No. A fraud alert asks lenders to verify your identity; a credit freeze blocks new credit checks entirely. Both are free. A freeze is the stronger move, and you lift it temporarily when you actually need credit.
How often should I change my passwords?
Not on a timer. Current NIST guidance (SP 800-63B, finalised 2025) is: don't rotate on a fixed schedule, but do change a password the moment it's exposed or you suspect compromise.