Check whether your email has been hacked

There are two very different things people mean by "my email's been hacked". One is that a website you signed up to was hacked and your address leaked. That's common, and usually fixed with a password change. The other is that someone has got into your email account itself. That's rare, and serious.

Leave Me Alone can settle the first question in a couple of minutes. Turn on Breach Detection and every address on your account is checked against Have I Been Pwned, the biggest list of known hacks. You'll see which hacks your addresses were in, what was taken, and what to do about it. For the second question, the signs are below.

Check my addresses

Leaked address or stolen account?

A data breach is when a company you gave your details to gets hacked and those details are copied. Your email address is almost always in there, often with a password, sometimes with your name, phone number, or home address. The stolen list gets sold on, which is why your inbox picks up spam and phishing emails mentioning sites you'd forgotten about.

Being in a breach doesn't mean your account has been taken over. Most people who've used the internet for a few years show up in at least one hack. The risk is that a password stolen from one site gets tried on your email, so if you reused it, change it. That's usually the whole fix.

Your email account itself has probably been broken into if you see any of these: sent emails you didn't write, replies to messages you never sent, forwarding rules or filters you didn't set up, password reset emails for other services you didn't ask for, sign-in alerts from places you've never been, or contacts telling you they've had strange emails from you. If any of that sounds familiar, skip to the section further down.

How to check every address you own

Breach Detection has its own page in Leave Me Alone. It's off by default, takes a minute to switch on, and there's a help article with screenshots.

1. Connect the accounts you want checked. Old addresses matter most here. They've been around longest and are the most likely to be in a hack, so connect them too.
2. Open the Breach Detection page and switch it on. It's in the sidebar. The only thing sent to Have I Been Pwned is your email addresses. Never your password, never your emails.
3. Wait for the results. Within a few minutes, on the same page, you'll see every known hack your addresses were in, newest first, with the site, when it happened, which address, and what kinds of details were stolen. Anything from the last year is labelled "new".
4. Deal with the "new" ones first. Click a breach for a description, how many people were affected, and advice matched to what was stolen. If a password was taken, change it on that site and anywhere you reused it.

On the free plan your addresses are checked when you switch it on and whenever you add an account. On a paid plan they're re-checked every week, so the next time a site you use gets hacked, you'll hear about it from us rather than from a spam email.

The full feature is described on our breach detection page.

Turn on breach detection

Seen something suspicious in your account?

If you've spotted any of the signs above, treat your email account as compromised and work through this in order. Change your email password first, from a device you trust, and make it one you don't use anywhere else. Turn on two-factor authentication. Then go into your account settings and look for forwarding addresses, filters, or rules you didn't create, and delete them. Attackers add these so they keep getting copies of your mail after you've locked them out.

Sign out of every other session or device, which most providers offer under security settings, and check the recovery email and phone number haven't been changed. Finally, change the passwords on anything important that's tied to that email, starting with banking and shopping, because a password reset sent to a hacked inbox is how the damage spreads. We've got a longer checklist in what to do after a data breach.

Checking by hand vs breach detection

You can check one address for free at Have I Been Pwned, and we use the same data. Here's the difference.

	Checking Have I Been Pwned yourself	Leave Me Alone
Addresses checked	One at a time	Every address on your account
The old address you've forgotten about	Only if you think to check it	Checked as soon as you connect it
Hacks discovered next month	Only if you go back and look	Re-checked every week on a paid plan
What to do next	A list of names, work it out yourself	Advice matched to what was stolen
The spam that follows a leak	Still lands in your inbox	Caught by the Spam Blocker

FAQ

Is my email hacked if it shows up in a breach?

Almost always no. A breach means a site you used lost your details. Your email account is only in danger if the password stolen was the same one you use for email. Change it and move on. The signs of a genuinely hacked account are sent mail you didn't write, rules you didn't set, and resets you didn't request.

How do I know if someone is reading my emails?

Look in your account's security settings for devices and sessions you don't recognise, and in your mail settings for forwarding addresses or filters you didn't create. Those are the two ways someone keeps reading after the initial break-in. Remove them, change your password, and turn on two-factor authentication.

Do you see my password?

No. We never have your email password, and Have I Been Pwned never returns passwords to anyone. The results only tell you that a password was among the details taken.

What do you send to Have I Been Pwned?

Your email addresses, and only while breach detection is switched on. Nothing else leaves Leave Me Alone.

Should I change my email address?

Almost never. Your address isn't the risk, the password is. Changing addresses means updating every account you own and telling everyone you know, and the new one will end up in a hack eventually too. Change the password, turn on two-factor authentication, and let the Spam Blocker deal with the junk. If you want a fresh address for signups, use a private email instead.

Why am I getting spam about a site I used years ago?

Because that site was hacked, and your address was in the stolen data. Spammers and scammers buy those lists and use the site's name to make their emails look real. Breach detection shows you which hack it came from, and the Spam Blocker keeps the emails out.

Can you get my details removed?

Not from a breach. Stolen data can't be un-stolen, so the list is a history of what's happened. Data broker sites are a different matter. If you're in the US, our partner EasyOptOuts removes you from those, with a discount for Leave Me Alone subscribers.

How much does it cost?

Breach detection is on every plan, including free. Free checks your addresses when you turn it on and when you add an account. Paid plans re-check every week and flag new hacks automatically.