A breached password means that exact password appears in a list of credentials taken from some service and published or traded. It does not necessarily mean anyone has used it against your account, and it does not mean the service that warned you was breached. It means the password is now a known guess.
That distinction sets the whole response. You are not repairing a break-in. You are removing the value of something an attacker already holds.
Quick answer
Change that password everywhere you used it, starting with your email account, then anything holding money, then everything else. Use a different password for each site. Turn on multi-factor authentication where it is offered. The leaked copy cannot be withdrawn, so the only thing that helps is making it useless.
What a "breached password" warning actually means
Browsers, phones and password managers compare your saved credentials against public breach lists. When one matches, you get a warning.
The warning tells you one thing: this password string is publicly known. It does not tell you that your account was accessed, that the site you saved it under was breached, or that anything has happened yet. The password may have leaked from a completely different service years ago.
Why that matters: attackers do not usually target one person. They take a list of known credentials and try it, automatically, across hundreds of sites. That is credential stuffing, and reuse is the only thing that makes it work.
Why a leaked password cannot be un-leaked
Copies of a breached list exist on machines nobody controls. There is no takedown process, no expiry, and no service that can remove your credential from it. Anyone who tells you otherwise is selling something.
What you can do is make the copy worthless. A password that no longer opens anything is just a string.
This is also why "changing the password back later" is not a plan, and why a variant — the same password with a digit added, or a year changed — is barely a change at all. Attackers apply those mutations automatically; it is a standard part of the tooling.
The order to change things in
Order matters because accounts are not independent. Your email account can reset the password on almost everything else, which makes it the master key whether or not you think of it that way.
- Your email account. Change it first, and check for anything an attacker would leave behind: forwarding rules you did not create, recovery addresses or phone numbers you do not recognise, and app passwords or connected apps you never authorised.
- Anything holding money or the ability to spend it. Banking, payment services, marketplaces with a saved card, anything with stored credit.
- Anything that can impersonate you. Social accounts, messaging, anywhere friends or colleagues would trust a message from you.
- Everything else that shared the password. This is where a password manager earns its place — it can list every site where a credential was reused, which memory cannot.
If the same password protected all four, treat it as urgent rather than tidy-up work. If it protected one throwaway forum account and nothing else, it is genuinely a small problem.
What to change it to
- Unique per site. This is the only property that stops credential stuffing. Length and complexity do not help if the same string is used in two places.
- Long rather than clever. A passphrase of several unrelated words beats a short string with substitutions. Current guidance from NIST is explicit that length matters more than composition rules, and that forced periodic rotation is counterproductive — it pushes people towards predictable variants.
- Generated and stored, not remembered. You cannot memorise a unique password for every account, and pretending otherwise is what produces reuse in the first place.
Turn on multi-factor authentication where it exists
A second factor means a stolen password is not enough on its own. Prioritise the accounts in the order above.
An app-based code or a hardware key is stronger than SMS, because a phone number can be moved to an attacker's SIM. SMS is still better than nothing, and on an account that offers no other option it is worth switching on.
What does not help
- Changing your email address. The leaked record still exists, and your new address will end up in some future breach too. It also breaks account recovery on everything tied to the old address.
- Deleting the account. Deleting an account after the data has left removes your access, not the copy in circulation.
- Paying a "removal" service to delete you from breach lists. They cannot reach the copies that matter.
- Changing the password to something similar. Covered above: mutation is automated.
How to know which of your passwords are affected
Check them, one by one, and check them properly. A well-designed check never receives the password: your browser hashes it locally and sends only a short fragment of that hash, so the service answering cannot reconstruct what you typed. You can check a password without sending it that way.
If a checker asks you to type a full password into a form that submits it to a server, do not use it. There is no reason to build one that way.
It is also worth checking whether your email address was exposed, because the two answer different questions: one tells you a credential is known, the other tells you which breaches your address appeared in and what else was taken with it.
Frequently asked questions
Does a breached password mean someone has my account?
No. It means the password is publicly known. Whether it has been used against you is a separate question — check the account's recent sign-in activity, which most large services expose in their security settings.
Do I have to change it if I do not use that site any more?
Yes, if you used that password anywhere else. The risk lives in the string, not in the site that leaked it.
How often should I change my passwords?
Not on a schedule. Change one when it appears in a breach, when you suspect it has been exposed, or when you are replacing a reused one with a unique one. Routine expiry produces predictable variations, which is why modern guidance dropped it.
Is a password manager safe?
Safer than the alternative it replaces, which is reuse. A manager concentrates risk into one vault, which is a real trade-off — protect that vault with a long unique passphrase and a second factor, and it is a good trade.
What if the breached password was for my email?
Treat it as the urgent case. Change it first, sign out all other sessions, then check forwarding rules, recovery options and connected apps before moving on to other accounts.
Conclusion
A breached password is not an emergency in the sense of a break-in, and it is not nothing. It is a known key that may still open doors. Changing it everywhere it was used — email first — and never reusing one again is the whole of the fix, and it is durable in a way that no removal service or address change can be.
Three things are worth reading next: why one breach becomes many, which is the attack this defends against; why unique passwords matter more than strong ones, which is why the fix is durable; and the breach exposure guide for the subject as a whole.