What to Do If Password Leaked: Email Recovery Guide

Learning that an email password may have appeared in a data breach can be unsettling, but a leaked password does not automatically mean someone accessed your email. The appropriate response is to secure the account, check for signs of unauthorized access, and address any other accounts where you reused the same password.

Email deserves particular attention because it is often a recovery method for banking, shopping, social media, cloud storage, and other services. Someone with access to an email account could potentially see sensitive messages or request password resets elsewhere.

Real Also: How to Check If Your Email Is in a Data Breach (And What to Do Next)

This guide explains what to do if password leaked information concerns your email account. It covers the order for changing passwords, signing out devices, enabling two-factor authentication (2FA), checking email forwarding rules, reviewing connected applications, and identifying account compromise signs without assuming that a breach has occurred.

Quick Takeaways

• A leaked password is a reason to replace that password; it is not proof that your email account was accessed.
• Go directly to your email provider’s official app or website instead of using a password-reset link in an unexpected breach notification.
• Change the email password to a new, unique credential and change any other account that reused the leaked password.
• Enable 2FA or a strong passwordless option such as a passkey when your provider supports it.
• Review recovery information, signed-in devices, active sessions, forwarding rules, filters, and connected applications.
• Sign out unfamiliar sessions and revoke app access you do not recognize or no longer use.
• Check financial or other sensitive accounts separately if the same credentials were reused or your email shows relevant unauthorized activity.
• If identity theft may be involved, US consumers can use the FTC’s official IdentityTheft.gov resources.

First: What Does “My Password Was Leaked” Mean?

Several situations can lead to a warning that your password has appeared in a leak.

Read Also: Phishing 101: How to Spot Scam Emails, Texts, and DMs

A company may notify customers of a confirmed data breach. A password manager or browser may flag a saved password as known to have been exposed. A reputable monitoring service may identify an email address in publicly documented breach data. Your employer’s security team might also ask you to change a credential following an incident.

These situations do not necessarily mean someone successfully logged into your email.

For example, suppose you used the same password on an old shopping website and your email account. If that shopping site’s credentials were exposed, your email provider itself has not necessarily experienced a breach. The problem is that someone in possession of the old shopping password could potentially try it with your email address elsewhere.

This is one reason cybersecurity guidance strongly recommends unique passwords.

A leaked password and a compromised account are different

It helps to separate two concepts:

• A leaked or exposed credential means information such as a password may have become available to unauthorized parties.
• An account compromise generally means an unauthorized person successfully gained access to the account.

The response overlaps, but you should not assume the second has happened simply because the first did.

If a credential is known or reasonably believed to have been exposed, replace it promptly and investigate the account using its legitimate security tools.

Step-by-Step: What to Do If Your Email Password Was Leaked

If you are unsure where to begin, use this order. The sequence prioritizes retaining control of your email and the accounts that depend on it.

Priority	Action	Why it matters
1	Verify the alert independently	Avoid acting through a deceptive message
2	Use a device you trust	Reduces unnecessary exposure during recovery
3	Change the leaked email password	Makes the old credential unusable for normal password login
4	Check recovery information	Confirms recovery still points to you
5	Enable or review 2FA/passkeys	Adds protection beyond a password
6	Review devices and sessions	Finds access you do not recognize
7	Check forwarding and filters	Identifies unexpected mail-routing changes
8	Revoke suspicious app access	Removes connections you do not recognize
9	Change reused passwords elsewhere	Prevents the same exposed password from affecting other accounts
10	Monitor important accounts	Helps identify additional unauthorized activity

Step 1: Verify the breach warning without using its link

If an email or text says your password was exposed, do not assume the message itself is genuine.

Instead of clicking its “Secure Account” or “Change Password” link, independently open the provider’s official app, use a bookmark you already trust, or manually enter a known official web address.

Then check the account’s security page for alerts.

If the notification concerns a breach at another company, look for that company’s official notice or information from a reliable source such as the FTC or CISA. Security alerts themselves can be imitated, so a sense of urgency is not evidence that a message is legitimate.

If your password manager or browser reports a compromised password, you can still navigate independently to the affected service before making changes.

Step 2: Use a device you trust

Make important security changes from your normal phone, tablet, or computer when possible. Install available operating-system and browser updates first if the device is significantly out of date.

Avoid changing sensitive credentials on a public or shared computer.

If you suspect your own device may have a security problem—for example, because security software has produced a specific warning or you observe unexplained account changes—consider using another trusted, updated device for immediate account recovery. Follow the device manufacturer’s or security provider’s official support guidance for the device itself.

A leaked password does not, by itself, mean your phone or computer is infected.

Step 3: Change your email password

Go directly to the email provider’s account settings and locate Security, Password, Sign-In & Security, or similar controls.

Create a completely new password. Do not simply make a small change to the leaked one.

For example, if an old password ended in 2025!, changing the ending to 2026! is not a good strategy. Choose an unrelated credential instead.

A password manager can generate and store a long, random password for you. If you need to remember a password yourself, a long passphrase constructed from unrelated words can be practical.

NIST’s current digital identity guidance emphasizes password length and advises against arbitrary periodic changes when there is no evidence of compromise. An exposed password is different: exposure is a valid reason to replace it.

Step 4: Check your account recovery information

Changing the password is important, but do not stop there.

Review the email account’s registered:

• Recovery email address
• Recovery phone number
• Trusted devices
• Authentication applications
• Passkeys
• Security keys
• Backup or recovery methods

Confirm that the information belongs to you and is current.

If you see an unfamiliar recovery method, follow the provider’s official security process to remove it and review the rest of the account. An unfamiliar entry can be significant, although it is still worth checking whether it belongs to an old device or configuration you recognize.

Step 5: Enable or review 2FA

If two-factor authentication is not already enabled, turn it on.

Google commonly calls this 2-Step Verification. Apple uses two-factor authentication for Apple Accounts. Microsoft commonly uses two-step verification for personal Microsoft accounts.

CISA recommends phishing-resistant MFA where available and practical. FIDO-based security keys and passkeys can provide strong phishing resistance. An authenticator app is another useful choice. SMS verification has limitations but can still provide an additional layer compared with a password alone when stronger methods are unavailable.

If 2FA is already enabled, review its registered methods. Make sure all listed phone numbers, authenticators, devices, passkeys, or keys are yours.

Remember that 2FA reduces risk but does not guarantee that unauthorized access is impossible. Do not approve login notifications you did not initiate, and never give unexpected callers or message senders your verification codes.

Step 6: Sign out of unfamiliar devices and sessions

Most major email providers let you review devices, sessions, or recent account activity.

Look for entries you do not recognize. Consider the device type, approximate location, date, and activity information supplied by the provider.

Location information can be imprecise. Internet providers, cellular networks, VPNs, travel, and other technical factors can make a legitimate sign-in appear to come from a nearby city—or sometimes much farther away. An unfamiliar location alone is therefore not conclusive evidence of unauthorized access.

If you find a session or device you reasonably believe is unauthorized, use the provider’s official controls to sign it out or remove it. Some providers also offer a broader “sign out everywhere” or equivalent option.

After a broad sign-out, you may need to sign back into mail applications on your own devices.

Step 7: Check email forwarding rules, filters, and delegates

This step is particularly important for email.

Email services may allow messages to be automatically forwarded, redirected, filtered, or shared with another account. These are legitimate productivity features, but an unexpected setting could cause copies of messages to go somewhere you did not intend.

Open your email settings and look for sections such as:

• Forwarding
• Filters
• Rules
• Mail rules
• Delegation
• Mailbox permissions
• Connected accounts
• Automatic replies

Review the settings for anything you did not create or authorize.

If you find an unfamiliar forwarding destination, filter, or delegation setting, use the provider’s official controls to remove it and continue reviewing the account’s security configuration.

Avoid deleting settings solely because you have forgotten their purpose. Some may have been configured by you, a workplace administrator, or a legitimate application. Check before removing settings on managed work or school accounts.

Step 8: Review and revoke app access

Many accounts let you authorize other applications without giving those applications your password directly. For example, a calendar application might request access to calendar data, or an email client might be authorized to access your mailbox.

This is generally implemented through delegated authorization systems such as OAuth.

Changing your password may not automatically invalidate every legitimately issued application authorization. That is why reviewing connected apps is a separate step.

In your account’s Security, Privacy, Apps, Third-party access, or similar section, look for applications and services with account access.

Revoke app access when:

• You do not recognize the application.
• You no longer use it.
• Its purpose is unclear and you determine you do not need it.
• It has permissions you no longer want to grant.

Do not panic if you see familiar applications. A mail client, calendar tool, smart device, or productivity application you intentionally connected may legitimately appear there.

Step 9: Check recent activity for account compromise signs

Review your provider’s recent security or sign-in activity if available.

Possible account compromise signs may include:

• Successful sign-ins from devices you do not recognize.
• Password or recovery settings changed without your action.
• Emails sent from your account that you did not write.
• Unexpected deletion or movement of messages.
• New forwarding rules or mailbox delegates you did not configure.
• Unknown connected applications.
• Security notifications corresponding to actions you did not take.
• Password-reset messages for other services that you did not request.

One sign does not always prove account takeover. For example, a password-reset email could have been triggered by someone entering the wrong address, and location information can be misleading.

Look at the overall picture and use the provider’s official security information.

Step 10: Change passwords on other accounts where you reused the leaked password

If the leaked email password was also used elsewhere, replace it everywhere it was reused.

Each replacement should be different.

This is the most important part of the change passwords order question: prioritize accounts according to how much control or sensitive access they provide.

A sensible order is:

1. Primary email accounts.
2. Password manager.
3. Apple, Google, or Microsoft platform accounts.
4. Banking, credit card, payment, brokerage, and similar financial accounts.
5. Mobile carrier.
6. Cloud storage.
7. Work or school accounts, following organizational procedures.
8. Social media.
9. Shopping and other accounts where the password was reused.

There is no need to change unrelated, already unique passwords simply because one credential was leaked, unless a provider advises you to do so for a specific reason.

Gmail: What to Review After a Leaked Password

For a personal Google Account used with Gmail, navigate directly to your Google Account and open Security. Google provides security information including recent activity, signed-in devices, recovery methods, and 2-Step Verification settings.

You can also review Gmail itself for forwarding and filtering settings. On the web version of Gmail, these controls are generally available through Settings. Menu organization can change, so search Google’s current Help documentation if you cannot find a particular option.

Check:

• Recent security activity
• Your devices
• Recovery email and phone
• 2-Step Verification methods
• Passkeys and security keys
• Third-party connections
• Gmail forwarding
• Gmail filters
• Delegated mailbox access, if applicable

If it is a Google Workspace account owned by your employer or school, your administrator may control some settings. Contact the organization’s IT department if you see activity you cannot address yourself.

Outlook and Microsoft Accounts: What to Review

For Outlook.com and other services connected to a personal Microsoft account, use Microsoft’s official account security page.

Review Sign-in activity, security methods, and other account controls Microsoft currently provides.

Within Outlook, check mailbox settings for rules, forwarding, and any other configured mail-routing features. Microsoft updates interface labels periodically, so use Settings search or current Microsoft Support documentation if the path has changed.

For Microsoft 365 work or school accounts, additional controls may be managed centrally. Follow your organization’s security procedures rather than changing administrator-managed settings on your own.

Apple and iCloud Mail: What to Review

If the affected email is associated with your Apple Account or iCloud Mail, review Sign-In & Security in your Apple Account settings.

On an iPhone or iPad, this is typically available by opening Settings, tapping your name, and finding Sign-In & Security. On macOS, open System Settings, select your Apple Account, and find the corresponding security section.

Review trusted devices and phone numbers, authentication settings, and recovery options. For iCloud Mail, also review relevant mail rules or forwarding settings through Apple’s supported interfaces.

Apple’s terminology and available settings can differ by operating-system version. Apple’s official support documentation is the best source for the current menu path.

How to Check Saved Passwords on Your Phone or Computer

If you cannot remember where the leaked password was reused, your password manager or browser may help identify duplicate credentials.

iPhone and iPad

Current Apple operating systems provide the Passwords app and related password-security features. Depending on your software version, open Passwords or search Settings for “Passwords” or “Security Recommendations.”

Review warnings about compromised or reused passwords and change affected credentials directly through the legitimate service.

Android

Android configurations differ by manufacturer. Search Settings for Password Manager, Passwords, Credential Manager, or open Google Password Manager if that is where your credentials are stored.

Google Password Manager can provide password security checks for saved credentials.

Windows

If you use a browser password manager or dedicated password manager, open its security or password-health function. In Microsoft Edge, search its current Settings for password-management options.

Do not install an unfamiliar “password leak checker” simply because an advertisement says your credentials are at risk.

macOS

Current Apple systems provide the Passwords app and password-related security recommendations. Other browsers and dedicated password managers have their own credential-health tools.

Whatever platform you use, rely on the password manager you already trust or a well-established provider rather than entering active passwords into random websites to see whether they have leaked.

Should You Search for Your Password on Breach Websites?

You generally do not need to type your current password into a public website to determine whether it has leaked.

Reputable password managers and browsers may provide compromised-password checks using privacy-preserving mechanisms. Services such as Have I Been Pwned can also help determine whether an email address appears in known breach datasets and provide specific password-search functionality designed not to require sending a complete password in ordinary plaintext queries.

For a beginner-friendly approach, use the security checking feature built into your established password manager, browser, or account provider. Never submit an active password to an unknown “breach checker.”

And remember: the absence of a warning does not prove a credential has never been exposed. No breach database has complete knowledge of every security incident.

If the Leaked Password Was Used for Your Password Manager

Treat this as a high priority.

Navigate directly to your password manager’s official app or website from a trusted device. Follow its security guidance for changing the account’s main password or authentication credential.

Review:

• Recent account activity, if provided.
• Authorized devices or sessions.
• MFA methods.
• Recovery configuration.
• Emergency access or family/organization settings.
• The provider’s current guidance for potentially exposed account credentials.

Do not assume that changing the main password automatically changes all passwords stored inside the vault. The appropriate response depends on whether there is evidence that vault contents may have been accessed and on the password manager’s architecture.

If you are uncertain, contact the provider through its official support channel.

If You Cannot Sign Into Your Email

Use your email provider’s official account-recovery process.

Avoid third-party websites or individuals claiming they can “hack back” into the account, bypass 2FA, recover secret passwords, or guarantee account access. Legitimate recovery should proceed through the provider or, for work and school accounts, through the authorized administrator.

During recovery, the provider may ask you to verify information associated with the account. Follow instructions shown on its official domain or application.

Once you regain access, work through the same checklist: password, recovery methods, MFA, devices, forwarding, rules, connected applications, and reused passwords.

What If Financial Information Was in Your Email?

Having financial emails in an inbox does not automatically mean a bank account is compromised.

If you find evidence suggesting unauthorized access to a financial account or transactions you do not recognize, contact the bank, credit union, card issuer, brokerage, or payment provider directly using a phone number on your card, statement, official website, or official app.

Do not use a phone number supplied in an unexpected security message.

If your email password was reused on a financial account, replace that financial password with a unique credential even if you do not see unusual transactions. Review the financial institution’s MFA and security-alert settings as well.

Could a Leaked Email Password Lead to Identity Theft?

It can create additional risk because email may contain personal information or password-reset messages, but a leaked password does not mean identity theft has occurred.

If you see indications that personal information is being misused—for example, accounts opened in your name that you do not recognize—US consumers can get official information and a recovery plan at IdentityTheft.gov, operated by the Federal Trade Commission.

The FTC also provides information about credit freezes and fraud alerts where relevant.

This article provides general cybersecurity information, not legal or financial advice.

Common Mistakes to Avoid

A common mistake is changing the password and assuming the job is finished. If unauthorized access had already occurred, a changed password may not address a new forwarding rule, connected application, unfamiliar recovery method, or every active session.

Another mistake is changing every password you own without checking where the leaked credential was actually reused. Focus first on the exposed credential and accounts sharing it. Every account should ultimately have its own unique password.

Do not respond to an alarming breach email by immediately clicking its password-reset link. Navigate to the provider independently.

Avoid small password variations such as changing a date, number, or punctuation mark. Use an unrelated, unique credential.

Do not approve an unexpected 2FA prompt or disclose a one-time verification code to someone who contacts you. The presence of 2FA reduces risk, but a person can still be tricked into authorizing a login.

Do not automatically remove every unfamiliar-looking device based only on an approximate geographic location. First consider your other devices, travel, cellular connections, workplace networks, and VPN use.

Finally, do not assume a leaked credential means malware is present on your device. Passwords can be exposed through service breaches and reuse without a phone or computer being infected.

How to Reduce the Impact of Future Password Leaks

You cannot control whether every company you use will experience a security incident. You can control how far one exposed credential can reach.

Use a password manager to give each account a unique password. That way, a leak involving one website does not directly reveal the passwords used elsewhere.

Enable MFA on important accounts. CISA recommends phishing-resistant MFA where available, such as FIDO-based authentication. Passkeys are another increasingly common option designed to provide strong phishing resistance.

Prioritize your primary email, password manager, financial accounts, mobile carrier, and Apple/Google/Microsoft platform accounts.

Keep recovery information current as well. A recovery phone number you stopped using years ago is not useful when you suddenly need account access.

FAQ

Does a leaked password mean my email was hacked?

No. A leaked password means the credential may have been exposed. It does not establish that someone successfully accessed your email.

Change the exposed password, then review account activity, devices, recovery information, forwarding rules, and authentication settings for signs of unauthorized access.

How quickly should I change a leaked password?

If a reliable source indicates that a current password was exposed, replace it promptly. Access the service through its official app or website rather than an unexpected message link.

The more important the account—and the more places where the credential was reused—the higher the priority.

What order should I change passwords in?

Secure your primary email first because it may be used to recover other accounts. Then prioritize your password manager, core Apple/Google/Microsoft account, financial accounts, mobile carrier, cloud storage, and other places where the leaked password was reused.

Each account should receive a different password.

Should I sign out of all devices after changing my email password?

If you suspect unauthorized access, signing out of other sessions can be useful. Providers differ in whether a password change automatically ends existing sessions, so review their current security controls.

Expect to sign back into legitimate devices afterward.

Why should I check email forwarding rules?

Forwarding rules can automatically send copies of messages to another address. They are legitimate features, but an unfamiliar forwarding rule could persist after a password change.

Review forwarding, filters, delegates, and related mailbox settings and remove configurations you determine are unauthorized.

Why should I revoke app access if I already changed my password?

Third-party apps often use authorization tokens rather than repeatedly storing and submitting your password. Depending on the provider, changing a password may not automatically revoke every authorized application connection.

Review connected applications separately and remove anything you do not recognize or no longer use.

Should I change passwords that were not leaked?

You generally do not need to change every unique password simply because one unrelated password was exposed.

You should change the exposed password and any other account password that was identical or reused. Also follow any specific instructions from a provider regarding its own security incident.

Is two-factor authentication enough to protect my email?

2FA provides an important additional layer but is not perfect. People can still be tricked into approving login requests or revealing some types of verification codes.

Use unique passwords or passkeys, secure recovery methods, current devices, and cautious handling of unexpected sign-in requests alongside 2FA.

What if the password leak happened years ago?

If the exposed password is no longer used anywhere, changing unrelated current passwords is generally unnecessary solely because an old credential appeared in a historical breach.

If you still use the password—or a close variation of it—replace it wherever it remains active.

Should I close my email account after a password leak?

Usually, a leaked password alone is not a reason to abandon an email address. In many situations, changing the credential and reviewing the account’s security configuration is sufficient.

If you cannot regain control or there are unusual circumstances, contact your email provider’s official support service for guidance.

When to Get Extra Help

Contact your email provider through its official recovery or support channels if you cannot sign in, recovery information has changed unexpectedly, unfamiliar sessions continue to appear, or you cannot remove a forwarding rule or connected application.

For work or school accounts, contact your organization’s IT or security team. Managed accounts can have administrator-created forwarding, retention, application, or access settings that individual users should not modify without guidance.

If unauthorized financial transactions appear, contact the relevant financial institution through a trusted number or its official application. If you suspect an unauthorized change to your phone number or mobile carrier account, contact your carrier through its verified support channel.

For possible identity theft, US readers can use the FTC’s official resources at IdentityTheft.gov. Reports involving immediate threats, extortion, stalking, or personal-safety concerns may warrant assistance from appropriate local authorities or specialized resources. In sensitive personal-safety situations, remember that changing shared devices or accounts may be visible to another person with access.

Conclusion: Your Leaked Password Checklist

If you remember only a few data breach steps, start with the account that gives access to the rest of your digital life: your email.

Use this short checklist:

• Verify the leak notification independently.
• Change the exposed email password to a unique one.
• Review recovery email addresses and phone numbers.
• Enable or review 2FA, passkeys, or security keys.
• Check devices and active sessions.
• Review email forwarding, filters, rules, and delegates.
• Revoke connected apps you do not recognize or use.
• Replace the leaked password everywhere it was reused.
• Monitor important accounts for activity you do not recognize.

A password exposure is manageable in many cases. The key is to replace the credential, check for persistent access methods, and make sure that one leaked password cannot unlock unrelated accounts.