iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
“773 million email addresses” refers to 772,904,991 unique addresses in Collection #1, a 2019 compilation of records from many older breaches—not a single new attack on one company. The cleaned collection also contained 21,222,975 unique passwords. The practical risk is password reuse: attackers can automate stolen email-and-password pairs against unrelated services.
What Collection #1 actually was
Troy Hunt’s account, published on 17 January 2019, described Collection #1 as an aggregation of credential data from numerous incidents. The raw files contained 2,692,818,238 rows and 1,160,253,228 unique email/password combinations. After cleanup, Hunt counted 772,904,991 unique email addresses and 21,222,975 unique passwords.
The files were found on MEGA in more than 12,000 files totaling over 87 GB and were advertised on a hacking forum. A forum post claimed they represented more than 2,000 dehashed databases, but Hunt said those alleged origins were not fully verified. The collection’s presence does not prove that every named service suffered a new breach at that time.
Why the collection was dangerous
Credential stuffing, not just list-making
Hunt defines credential stuffing as “the automated injection of breached username/password pairs in order to fraudulently gain access to user accounts.” Attackers take a pair such as an exposed email address and password, then test it automatically on email, shopping, social-media, financial and workplace services.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
A password exposed years ago can still work if you reused it, never changed it, or used a minor variation elsewhere. The age of the original breach does not make a reused password safe.
What the headline does—and does not—tell you
- The 772,904,991 figure is a count of unique email addresses after cleanup, not the number of people proven to be actively hacked.
- The 21,222,975 figure is a count of unique passwords, not a count of passwords matched to every listed address.
- The raw 2.69-billion-row figure includes duplicates and records in mixed formats.
- Being listed in Collection #1 does not identify which service originally exposed a particular record.
How to tell whether your email was included
- Enter your email address into Have I Been Pwned (HIBP).
- Review the breach names and dates shown for that address.
- Interpret a result as evidence that the address appeared in known breach data, not as proof that every listed password still works.
HIBP does not display the password paired with your email address. That separation is intentional: an email lookup should not become a way to reveal someone’s credential.
How to check your passwords safely
Use HIBP’s Pwned Passwords service to test a password. It uses an anonymised, k-anonymity-based lookup: the service is designed to check whether a password appears in indexed breach data without receiving the actual password value. Do not paste a password into an unknown “breach checker” or send it to a person claiming to investigate your account.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
If a password appears in Pwned Passwords, treat it as compromised. Replace it anywhere you used it, including accounts where you changed only capitalization, punctuation or a trailing number.
What to do after an exposure result
1. Change the reused password first
Start with your primary email account, password-manager account and any account that can reset other services. Create a different password for each account. A password manager can generate and store unique passwords; if you prefer offline storage, Hunt says writing unique passwords in a book and keeping it inside a physically locked home is far better than reusing one password across the web.
2. Turn on two-factor authentication
Enable two-factor authentication wherever the service offers it, prioritising email, financial, administrator and work accounts. Two-factor authentication adds a second proof of identity, so a stolen password alone is less likely to be enough.
Rank #3
- ✅ PROTECT ONLINE ACCOUNTS – A password manager, two-factor security key, and secure communication token in one, OnlyKey can keep your accounts safe even if your computer or a website is compromised. OnlyKey is open source, verified, and trustworthy.
- ✅ UNIVERSALLY SUPPORTED – Works with all websites including Twitter, Facebook, GitHub, and Google. Onlykey supports multiple methods of two-factor authentication including FIDO2 / U2F, Yubico OTP, TOTP, Challenge-response.
- ✅ PORTABLE PROTECTION – Extremely durable, waterproof, and tamper resistant design allows you to take your OnlyKey with you everywhere.
- ✅ PIN PROTECTION – Locking your device means that if this device is stolen, data remains secure, after 10 failed attempts to unlock all data is securely erased.
- ✅ EASY LOG IN – No need to remember multiple passwords because by plugging OnlyKey to your computer, it automatically inputs your username and password. It works with Windows, Mac OS, Linux, or Chromebook, just press a button to login securely!
3. End active sessions and review recovery settings
After changing a high-value password, use the service’s security settings to sign out other sessions if that option exists. Check recovery email addresses, phone numbers, authenticator devices, forwarding rules and unfamiliar app permissions. Remove anything you did not add.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Watch for follow-up attacks
Exposure lists can fuel convincing phishing messages. Treat unexpected password-reset links, “breach notification” attachments and urgent requests for one-time codes as suspicious. Open the service through its normal app or a saved address instead of a message link.
Password manager or paper notebook?
Hunt specifically recommends a password manager for strong, unique passwords and discusses 1Password Watchtower’s HIBP integration and bulk checking. He also notes that a locked physical notebook is a reasonable offline alternative for people who do not want cloud storage. The choice depends on how you balance convenience, recovery and physical access.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
| Consideration | Password manager | Offline notebook |
|---|---|---|
| Unique-password generation and storage | Designed to generate and store unique passwords; exact features vary by product. | Stores passwords physically; you create and update entries yourself. |
| Breach alerts and password checks | 1Password Watchtower integration and bulk checking are documented by Hunt; current product features should be confirmed with the provider. | Not stated; checking must be done separately with a breach-checking service. |
| Device and platform coverage | Depends on the manager and its current apps or browser extensions. | Available wherever the notebook is physically present. |
| Recovery and lockout | Depends on the manager’s account-recovery design; losing the account’s recovery method can block access. | No online account lockout, but loss, theft or damage to the notebook can remove access. |
| Storage preference | Usually involves encrypted digital storage and synchronization; verify the provider’s current architecture. | Offline storage inside a physically locked home, as Hunt recommends. |
Common misunderstandings
“Was my email in the 773-million breach?”
Collection #1 was not one company’s breach. HIBP can show whether your address appears in its indexed breach records, but that result does not establish that a single 773-million-user database was taken from one service.
“Are all my passwords in Collection #1?”
Only passwords that appeared in the indexed data can be found by a Pwned Passwords check. A clean result does not prove that a password has never leaked anywhere; it means the password was not found in that service’s current corpus.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute“Can an old leaked password unlock another account?”
Yes—if you reused it and the other service accepts it. Credential-stuffing tools are built to test those reused pairs at scale. Changing the password everywhere it was reused removes that direct path.
Key takeaway
Collection #1’s headline numbers describe a historical aggregation: 772,904,991 unique email addresses and 21,222,975 unique passwords after cleanup. Your protection does not depend on identifying the original breach. Check your email with HIBP, test passwords through Pwned Passwords, replace every exposed or reused password with a unique one, and enable two-factor authentication on important accounts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
