Should I change my password after a data breach?
Yes, on the breached account and on every account where you used the same password. Do it now, starting with your email. If the breach exposed no passwords, changing is still a sensible step. Use a new password for each account and turn on two-step sign-in.
Last read from the sources at the foot of this page.
What does it mean for you?
NIST, whose password guidelines US federal agencies follow, says a password should change when there is evidence it was compromised.
verifiers SHALL force a change if there is evidence that the authenticator has been compromised.
Which accounts first?
Your email first, because every other account sends its reset link there. Then banking, then any account that shared the password.
What should you do?
Change your passwords right away for your online accounts affected by the breach.
- Change the password on your email account.
- Change it on the breached account and on every account that used the same password.
- Use a password manager to make a different password for each.
- Turn on two-step sign-in where it is offered.
Where is the change made?
Each account named, in its own security or password settings. Your email account settings come first, because a reset link for every other account goes there.
What else do people ask about this?
Should I change all my passwords every few months?
No. NIST says services should not force regular changes. Change a password when it may be compromised.
What if I cannot remember where I used it?
A password manager can search your saved passwords for it. Start with email, banking and shopping.
Where does this come from?
- NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Managementpages.nist.govRead 16 October 2026
- Office of the Privacy Commissioner of Canada, Identity theftpriv.gc.caRead 16 October 2026
Is your email address in a public breach?
Enter one address. We look it up in monitored breach databases and show which breaches list it and what each exposed.