iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If your password has leaked and you can still sign in, change it to a new, unique password in the service’s official app or website, then use its security settings to review and sign out unfamiliar devices or sessions. These are separate steps: changing a password does not necessarily end every session already open. If you cannot sign in, start with the provider’s official account-recovery process.
Change the leaked password and revoke other sessions
- Open the official service. Use its app or type its known website address yourself. Avoid unexpected password-reset links in email or text messages.
- Replace the password. Choose a strong password that you have not used for another account. The Federal Trade Commission recommends aiming for 12 to 15 characters or using a passphrase in its October 2024 consumer guidance. A password manager can help you create and keep track of unique passwords.
- Open the security or device settings. Review recent sign-ins and devices, then sign out sessions you do not recognize. If there is a sign-out-everywhere option and you need to revoke other sessions, use it after checking which devices and services it covers and how long it may take.
- Turn on two-factor authentication. Enable it if the service offers it, using the provider’s instructions.
Changing a password and signing out other devices solve different problems. A password change protects future sign-ins using the old password; session controls address access that may already be active. The exact effect and timing depend on the service.
Check for account changes and repeat password use
After securing access, look for changes an intruder may have made. Check that your recovery email address and phone number are yours and accessible. Review connected apps and other account settings, including email forwarding rules, for unfamiliar entries. Google recommends reviewing recent security events and devices, correcting unfamiliar account or recovery information, and changing other passwords where the same password was used or the affected Google account is used for access or recovery (Google Account Help).
If you reused the leaked password, replace it anywhere else it was used. Prioritize the email account that receives password-reset messages and accounts that use that email address for sign-in or recovery. An exposed email account can help someone take over other accounts.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
If you cannot sign in
Use the affected provider’s official account-recovery process; do not rely on links or phone numbers from an unexpected message. The FTC advises people locked out of a hacked email or social account to follow the provider’s recovery instructions (FTC guidance on hacked social accounts). Once you regain access, change the password, review recovery details and account activity, and notify contacts if the account may have sent messages they could mistake for yours.
Provider examples: Google and Microsoft
Google Account
Google’s devices page lists devices where you are signed in or were signed in recently and lets you sign out of a device or session. A single device can have multiple sessions—for example, separate browser, app, or service sign-ins. If you need to ensure access from that device is ended, Google says to sign out all sessions shown with that device name. A recent activity time can reflect background communication, so a timestamp later than your last manual use does not, by itself, prove someone else accessed the account.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Microsoft account
Microsoft’s sign-out-everywhere instructions say the action can take up to 24 hours and excludes Xbox consoles. Do not assume every Microsoft-connected device loses access immediately. Microsoft also lists physical security keys as a passwordless sign-in option; a compatible key is optional added protection, not a substitute for replacing a leaked password or ending active sessions.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If the device may be infected
If you suspect malware or other compromise of the device you use to sign in, follow the affected provider’s device-specific guidance. For Microsoft accounts, Microsoft advises running an up-to-date antivirus full scan before changing or resetting the password. After regaining control, Microsoft also advises checking connected accounts, email forwarding, and automatic replies. This is Microsoft-specific advice, not a universal prerequisite for every password leak.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use the affected service’s instructions
Google and Microsoft illustrate why there is no single sign-out procedure for every account: one service may let you end individual device sessions, while another may offer an account-wide action with delays or exclusions. Banks, social platforms, work accounts, and other providers can use different controls and recovery steps. Follow the official instructions for the account that was exposed, and check the stated scope and timing before assuming other devices have been signed out.
Quick Recap
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
