Your inbox looks normal, which is exactly the problem. A data breach rarely announces itself with a dramatic pop-up. It happens quietly on a server you have never heard of, and months later your email address, password, or home address shows up in a file traded on some forum. You keep using the same credentials, none the wiser.

That is why a five-minute habit is worth building: check your email against a breach database every few months. The tools below are free, they do not require your password, and each one answers a slightly different question. Used together, they give you a clear picture of what is already exposed.

What a breach checker can and cannot tell you

These services keep records of email addresses that appeared in publicly disclosed breaches. When you type your address into one, it matches your string against that archive and reports any hits. That is it. It is a lookup, not a scan of your computer or your accounts.

So a "no results" answer means nothing bad has been found in the databases that particular service tracks. It does not mean your accounts are safe. Some breaches are never disclosed, some companies never admit them, and plenty of leaked data circulates without being added to any public archive. Treat a clean result as mild reassurance, not a clean bill of health.

Have I Been Pwned: start here

Troy Hunt's Have I Been Pwned is the reference point for this category, and it stays free for individual checks. Enter your email and you get a list of breaches, each with a description of what was exposed: email addresses only, or passwords, phone numbers, physical addresses, payment details.

Two features are worth knowing about. First, you can subscribe to notifications for a specific address, so you get an email if it turns up in a future breach. Second, the site has a separate password checker. Type a password and it tells you how many times that exact string has appeared in known leaks — using a method that does not send your full password over the network. If a password you still use shows up there in the thousands, change it today.

Check every address you own, not just your main one. Old school accounts and forgotten Gmail addresses are the ones that end up in leak after leak, and they often still control other accounts through password resets.

Mozilla Monitor and Firefox Relay

Mozilla's Monitor tool does the same core job with a friendlier interface, and you can add multiple email addresses to one dashboard. If you already use Firefox, it slots in neatly. The notifications are clear and the plain-language summaries are genuinely useful if you are checking on behalf of a family member who finds the raw breach listings confusing.

Worth mentioning alongside it: Firefox Relay. You create random alias addresses (something like xyz123@relay.firefox.com) and hand those out to shops, newsletters, and one-off sign-ups. If the alias appears in a breach, you simply switch it off. Your real address was never in that database.

Google and Apple's built-in warnings

If you use Chrome or a Google account, the password manager will flag saved credentials found in breaches and prompt you to change them. Apple does something similar with iCloud Keychain, warning you about weak, reused, or leaked passwords across your devices.

These are easy to ignore and easy to dismiss. Do not. The alert is not generic nagging — it is tied to a specific saved login, and it tells you precisely which account needs attention. Spend ten minutes clearing those warnings and you have closed the most obvious holes.

Other tools worth a look

• DeHashed — a paid service with a limited free search. Useful for checking a work address or a domain, though the free tier is restrictive.
• LeakCheck — similar model, quick interface, free results show basic hits.
• Identity Leak Checker — run by a German research institute, free and privacy-focused, good for a second opinion on European data.
• Your bank and email provider — many now run their own monitoring. Check your security settings; the alert is often already switched on.

One rule applies to all of them: never pay a random site to "remove" your data from the internet. Breach archives are copies, and nobody can delete them from a thousand mirrors. Anyone promising that is selling you nothing.

What to do when your credentials appear in a leak

Work through this in order. It takes less time than you think.

1. Change the password on the affected account. Make it long and unique — a passphrase of four or five random words beats a clever eight-character scramble.
2. Change it anywhere else you reused it. This is the step people skip and the one that matters most. One leaked password plus reuse equals a chain of compromised accounts.
3. Turn on two-factor authentication. Use an authenticator app or a hardware key where possible. Text messages are better than nothing but can be intercepted.
4. Check for changes you did not make. Look at recovery email addresses, forwarding rules, linked phone numbers, and recent login activity. Attackers add these to keep access after you reset your password.
5. Watch for targeted phishing. Now that a stranger knows your name, address, and which bank you use, a convincing fake email is much easier to build. Be suspicious of urgency and unexpected attachments.
6. Consider a password manager. It generates and stores unique passwords so this whole problem shrinks over time.
7. Freeze your credit if sensitive data leaked. If the breach included your national ID number, date of birth, or financial details, contact your bank and consider a credit freeze or fraud alert. Rules vary by country, so check with your bank or a consumer protection agency before acting.

Make it a routine, not a panic

Set a reminder for every three or four months. Open Have I Been Pwned, check each of your addresses, then spend five minutes clearing any warnings in your browser's password manager. That is the whole routine, and it takes less time than making coffee.

The bigger shift is mental. Assume that any address you have used for more than a few years is already in some database somewhere. Once you accept that, the practical response becomes obvious: unique passwords for everything important, two-factor authentication switched on, and aliases for the throwaway sign-ups. Breaches will keep happening. Whether they cost you anything is largely up to how you have set things up.

Photo: kaboompics / Pixabay