The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Open the password manager or browser that stores the login and run its security check. A flagged password usually matches credentials found in a known third-party breach. Replace it promptly with a unique password, change every account where you reused it, and enable multifactor authentication (MFA). The warning does not by itself prove that someone signed in or that your password manager was breached.
What an exposed-password warning actually means
Password checkups compare saved usernames and passwords with information associated with known data breaches. Google describes Chrome’s check as a comparison of encrypted credentials with an encrypted list of known breached data. Microsoft describes an Edge match as a password that entered the public domain after a third-party leak.
The match is evidence that the password is no longer secret. It is not proof that an attacker accessed your account, and it does not mean the browser or password manager itself was exposed. Attackers may still try the leaked combination against the affected service and other services where the same password was used.
A match is a reason to act, not a reason to panic
- Established: the credential resembles data already associated with a known breach.
- Not established by the match alone: whether anybody logged in, what data may have been viewed, or whether recovery settings were changed.
- Urgent risk: reuse. A password leaked from one site can be tried automatically on other sites.
Check the saved credential directly
Use the security feature in the app or browser that stores the login. Menus can change; if the wording below differs, look for security checkup, compromised passwords, or a similar section.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Google Password Manager or Chrome
- In Chrome, open Passwords and autofill.
- Open Google Password Manager.
- Select Checkup.
- Review any exposed, weak, or reused credentials and open the affected service’s password-change page from the result.
Chrome can also warn automatically about exposed passwords. If a warning arrived by email or message, do not use its link as proof. Open Chrome or the Password Checkup page directly and verify the result there.
Microsoft Edge
- Open Settings.
- Select Passwords and autofill.
- Open Microsoft Password Manager.
- Select Password security check.
- Use the result to identify the account, then navigate to that service and change the password.
Edge’s warning means the stored password matches known leaked credentials from a third-party source. It does not mean Edge’s own storage was exposed.
Apple iPhone
- Open the Passwords app.
- Tap Security.
- Review each flagged account and follow the service’s password-change process.
Apple’s password settings also include a Detect Compromised Passwords option. Keep that detection enabled if you want the device to continue identifying known matches.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If your browser has no checkup
Look in the security area of the password manager or device that stores the credential. If it has no breach comparison, you can still change the password at the service, audit reuse manually, and check the email address associated with the account through Have I Been Pwned. An email lookup is an additional breach check; it is not a substitute for examining the saved password itself.
How the checkup tools differ
| Tool | Where to open it | What it can flag | Change-password handoff |
|---|---|---|---|
| Google Password Manager/Chrome | Passwords and autofill → Google Password Manager → Checkup | Known exposed passwords, plus weak or reused credentials where reported | Results can direct you to the relevant service |
| Microsoft Edge | Settings → Passwords and autofill → Microsoft Password Manager → Password security check | Credentials matching known leaked data | The result lets you move to the account to change its password |
| Apple Passwords | Passwords app → Security | Accounts flagged by Apple’s compromised-password detection, along with other security warnings shown there | Open the listed account and use that service’s own change-password controls |
| Have I Been Pwned | Email-address breach lookup | Whether an email address appeared in a listed breach | No direct saved-password audit; use the affected service’s official security page |
These interfaces are not a proven ranking. Compare them by whether scanning is automatic or on demand, whether weak and reused passwords are included, and how clearly the result connects to the service’s password-change flow. A tool may scan only credentials saved in that particular browser, device, or vault, so check each place where you keep logins.
What to do immediately after a match
- Verify the alert safely. Open the password manager or browser settings yourself. Treat an email, text, or pop-up link as untrusted until the same warning appears in the official app or browser.
- Change the password at the affected service. Use the service’s official app or type its known address manually. Do not change it through an unfamiliar link. Create a password that has never been used on another account.
- Change reused versions elsewhere. Search for the same password, a shortened form, a changed capitalization, or a predictable suffix on every other account. Each account needs its own replacement.
- Enable MFA. Turn it on for the affected account and for important accounts that offer it. MFA can help protect an account even when its password is compromised.
- Check recovery details. Confirm that the recovery email address, phone number, authenticator devices, and backup codes are yours. Remove unfamiliar entries and create new backup codes if the service supports that option.
- Review recent activity when available. Look for unfamiliar sign-ins, password-reset notices, sent messages, purchases, or profile changes. Record dates and locations before deleting alerts.
- Escalate if access appears to have occurred. Follow the service’s official account-recovery process, secure the associated email account, and contact the service through a verified support channel if you are locked out or recovery settings were changed.
Which account should you change first?
Start with the account named in the warning, then work through any account that reused the password. If several accounts are involved, prioritize your primary email, financial and shopping accounts, cloud storage, work systems, social accounts with payment or identity information, and administrator accounts. An email account deserves special priority because control of it can enable password resets elsewhere.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
Use a trusted device, keep the password manager open if it can generate and save the replacement, and sign out of other sessions when the service offers that control. A password change is not complete until the new credential is saved correctly and you can sign in with it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Audit password reuse without missing accounts
Changing only the account named in the warning is insufficient if the password appeared anywhere else. Work from your saved-login list rather than memory.
- Export or open the list of saved accounts in your password manager or browser.
- Start with accounts containing payment information, identity documents, work data, or administrator privileges.
- For each account, ask whether the exposed password or a close variant was ever used there.
- Change matches immediately, using a different generated password for every service.
- Mark each account as completed only after the new credential is saved and the old one no longer works.
Do not make a “new” password by changing one character of the old password. Predictable variants can be guessed from the original leak. Include older accounts, alternate logins, family profiles, developer tools, forums, and services you rarely use. If you no longer need an account, close it through the service’s official procedure rather than leaving a reusable credential active.
Turn on multifactor authentication
NIST’s guidance says, “The first thing you should do is add multifactor authentication.” It identifies authenticator apps, push notifications, text-message codes, and USB security keys as common forms. Availability and security differ by account, so choose the strongest method the service supports and that you can reliably use.
| Method | What to check | Practical safeguard |
|---|---|---|
| Authenticator app | Whether the service supports app-generated codes and how it handles device loss | Store the service’s backup codes somewhere separate from the phone |
| Push notification | Whether prompts identify the service and location clearly | Deny prompts you did not initiate; repeated unexpected prompts should be treated as a warning |
| Text message code | Whether it is the only available option and whether your phone number is current | Keep recovery details updated and use a stronger option if the account offers one |
| USB security key | Whether the account and your devices support the key | Register a spare key or another approved recovery method before losing the primary key |
Not every account supports a hardware key, and an MFA method is useful only if you can recover the account when your device is unavailable. Record recovery codes offline and never share one-time codes with someone who contacts you unexpectedly. Compare MFA options on three practical axes: whether the account supports them, how resistant they are to phishing, and whether you can use them consistently.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsLook for signs of account access
A breach match and an account takeover are different events. Investigate further if you see any of these signs:
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
- an unfamiliar sign-in, device, location, or session;
- a password-reset or MFA enrollment notice you did not request;
- changed recovery email addresses, phone numbers, or security questions;
- messages, posts, purchases, or transfers you did not make;
- an account locked because of repeated failed or successful sign-ins.
Use the service’s security page to sign out unknown sessions, revoke unfamiliar app access, reset the password again from a trusted device, and restore your recovery information. If the account controls an email inbox, secure that inbox first because it may be used to reset other accounts. Preserve suspicious notices and transaction details for the service’s support team, and use only contact details reached through the official site or app.
Use an email breach lookup as a separate check
Have I Been Pwned provides a free way to check whether an email address appeared in a reported data breach. Search each important address you use, including older addresses that may still be tied to accounts.
A result means the address appeared in breach data; it does not reveal whether a particular saved password is still being used or whether an attacker accessed your account. After a result, identify the affected service, change its password and any reused variants, and turn on MFA. If the lookup finds nothing, do not treat that as proof that every password is safe: breach databases are not complete, and a saved-password check examines a different signal.
Do you need to pay for a check?
The core response normally requires no paid service. Google Password Manager, Chrome, Microsoft Edge Password Monitor, and Apple Passwords include their security checks in the products that store the credentials. Have I Been Pwned offers a free email-address lookup. You do not need to buy a cleanup program or respond to a payment demand to change a compromised password.
An optional FIDO2 security key can provide another MFA method, but it is relevant only for accounts that support security keys. Check compatibility before buying one, and register a spare or another recovery method so losing the key does not lock you out. The essential steps—verify, replace, remove reuse, and enable available MFA—remain available without purchasing hardware.
Use a password manager to prevent the next exposure
A password manager can generate a different random password for each account and store it so you do not have to memorize every credential. Choose one that supports strong generation settings, secure vault recovery, and MFA for the vault itself.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
- Set the generator to produce a unique password for every service.
- Save the login only after confirming that the account’s official domain or app is correct.
- Protect the vault with MFA when available.
- Keep recovery information current and store emergency codes offline.
- Review the manager’s security check periodically, not only after receiving an alert.
The vault becomes a high-value account. A unique master password, MFA, current recovery details, and protection of the devices that unlock it matter as much as the individual logins inside it.
Recommended Free Tools
Common mistakes and how to recover
Following the warning link in an email
Phishing messages can imitate security alerts. Close the message, open the browser or app yourself, and run the checkup from its settings. If you already entered credentials on a suspicious page, change that password from a trusted device, enable MFA, and review account activity.
Changing only one reused password
List every account that used the exposed credential or a recognizable variation. Change the highest-impact accounts first, then complete the rest with unique passwords.
Assuming a match proves a takeover
Use the warning as a trigger for prevention. Check sign-in and recovery activity separately; take account-recovery steps only when those checks show unfamiliar access or you cannot sign in.
Ignoring old accounts
Unused accounts can still expose reused passwords. Change credentials on accounts you keep, close accounts you no longer need through their official procedures, and remove saved logins that are no longer valid.
Assuming one clean check covers every login
A browser check sees the credentials stored in that browser or synchronized vault. Repeat the review in other password managers, browsers, phones, or work profiles you use. Also check important email addresses separately because an email breach lookup and a saved-password comparison answer different questions.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
A practical response checklist
- Run the checkup in the password manager or browser that stores the login.
- Confirm the result inside the official app or settings, not through a message link.
- Change the affected service’s password to a new, unique value.
- Change every reused password or close variant on other accounts.
- Enable MFA and save recovery codes securely.
- Review sign-ins, sessions, recovery settings, and connected apps.
- Check associated email addresses separately with an email breach lookup.
- Use official recovery support if you find unauthorized changes or lose access.
Frequently Asked Questions
Does a warning mean my password manager was hacked?
Usually no. Google, Microsoft, and Apple compare saved credentials with information associated with known breaches. Microsoft specifically says an Edge match reflects a third-party leak, not exposure of Edge’s own storage.
What if the checkup finds no exposed password?
Keep using unique passwords and MFA. A clean result only covers the credentials and breach data that tool checks; it does not prove that every account or email address is absent from every breach.
Is Have I Been Pwned the same as a saved-password check?
No. Have I Been Pwned checks whether an email address appears in reported breach data. A browser or password-manager check compares saved credentials with known leaked credentials.
Which MFA method should I choose?
Use the strongest method the account supports and you can reliably recover. Consider compatibility, phishing resistance, and convenience. Authenticator apps, push prompts, text codes, and USB security keys are common options, but not every account supports each one.
Do I need to buy a security product after a match?
No. The built-in checks, password changes, MFA enrollment, and Have I Been Pwned’s email lookup can handle the core response. A FIDO2 security key is optional and only useful where the account supports it.
What should I do if I clicked an alert link and entered my password?
From a trusted device, change that password at the service’s official site, change any reused variants, enable MFA, and review sign-ins, recovery settings, and connected sessions. Contact the service through verified support if you lose access.
The Bottom Line
A saved-password match means the credential appears in known breach data, not that your password manager was necessarily breached or that someone definitely signed in. Verify the warning in the official checkup, change the password at the affected service, replace every reused variant, enable MFA, and review account activity and recovery settings. Use an email breach lookup as a separate check, and rely on official recovery support if you find unauthorized changes or lose access.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
