How to Check for Leaked Passwords Safely
The video explains how to check whether a password appears in leaked data without handing it to a suspicious site. It distinguishes email breach lookups from password checks and shows how Have I Been Pwned checks a password using only part of its scrambled code.
A Mac test demonstrates the process, followed by built-in checks in browsers and password managers. The video explains why a match does not prove an account is hacked, while no match does not prove a password is strong.
It also covers fake breach warnings, predictable password changes and NIST guidance against forced regular changes. It recommends replacing exposed passwords everywhere they are reused, choosing unique passwords and using passkeys where possible.
Key points
- Have I Been Pwned offers separate checks for an email address appearing in breaches and a password appearing in leaked data.
- The demonstrated password check sends only the first five characters of a scrambled code and finds the match locally.
- Browsers and password managers offer saved-password checks and say they cannot see the passwords themselves.
- A match does not prove an account is hacked, and a missing match does not establish password strength.
- Fake breach alerts lead to look-alike sites that capture passwords, so the video recommends opening the real site independently.
- The video recommends replacing exposed passwords, avoiding predictable tweaks, and using unique passwords and passkeys rather than forced regular changes.
Chapters
The description and key points were written with AI from the video's transcript and checked against it, then reviewed by Vishal on . The video plays from YouTube. How we write and check our work.
