Quick answer
Change the password on every account that shares it, starting with email, banking and anything that can reset something else. The leaked site matters less than the fact that the same password unlocks other accounts.
Breach lists circulate for years, and the same email address appears in dozens of them. Almost none of those lists matter on their own: a password for a forum abandoned in 2019 cannot hurt anyone. What hurts is reuse — one string unlocking a mailbox, a bank and a shop at the same time.
Order of operations after a leak
- Email first. If the mailbox is taken, every other account can be reset through it.
- Anything financial: banking, card apps, payment platforms, then any account with a saved card.
- Accounts that can reset others or that hold identity data: government services, health portals, cloud storage, work accounts.
- Then everything else, in whatever order is fastest — and this time, generated and unique per account.
- Turn on two-factor authentication where it is offered, preferring an app or a hardware key over SMS.
Checking a password without sending it anywhere
The BaitScan password check uses the k-anonymity model: your browser computes the SHA-1 hash of the password and sends only the first five characters to the Pwned Passwords range API. The server answers with every hash suffix beginning with those five characters, and the comparison happens on your device. The service learns a prefix shared by hundreds of thousands of passwords, never the password — and nothing is logged or stored, because the whole check runs in the page.
- A hit tells you the password has appeared in a breach. It does not say which, or whether the account is still active.
- No hit is not an all-clear: a password that has never leaked can still be guessed, especially if it is short or built from a pattern.
- Never paste a password into a site that asks for the password itself rather than checking it locally — that is precisely the distinction to look for.
Better than changing passwords: not needing to remember them
A password manager turns a breach from an emergency into a chore: one list of accounts to update, each with a different password, none of which needs to be memorised. The manager's own master password and its recovery codes then become the two things worth protecting most — which is also why those recovery codes belong on paper, not in the same cloud account.
Frequently asked questions
The questions this article gets asked most, answered directly.
Does sending five characters really protect the password?
It makes the request useless on its own. Those five hex characters match hundreds of thousands of passwords, so the answer cannot identify one of them without the rest of the hash, which never leaves your device. Compare the alternative: a site that asks for the password itself knows the password.
My email was in a breach from years ago. Do I still need to act?
Act if that password is still in use anywhere. Leaked lists are reused for years precisely because people keep old passwords on new accounts. If you have since changed it and never reused it, there is nothing to do.
Is it worth changing a password to a variant, like adding a number?
No. Attackers' dictionaries generate exactly those variants, and a tool that already knows the old password tries the predictable transformations first. A new password must be independent, not related.
Written by The BaitScan editorial team
Results are automated risk estimates based on public indicators and heuristics.