My password manager says my password was compromised. What now?
It found that password on a list from a past breach. The password manager was not hacked. Change the password on that account, then on any other account that uses it. Let the manager create a new, unique one each time. Turn on two-step sign-in where it is offered.
Last read from the sources at the foot of this page.
What does it mean for you?
Password managers check your saved passwords against breach lists. CISA describes what they do.
Password managers tell us when we have weak or re-used passwords and can generate strong passwords for us.
What should you do?
We recommend that you change any compromised passwords as soon as you can.
- Open the warning and note which accounts use the password.
- Sign in to each account directly and change the password there.
- Save the new password in the manager.
- Turn on two-step sign-in for email and banking first.
- Dismiss the warning only after the password is changed everywhere.
Where is the change made?
Each account named, in its own security or password settings. Your email account settings come first, because a reset link for every other account goes there.
What else do people ask about this?
Does the warning mean my password manager was breached?
No. It means a website where you used that password lost its records. The manager is telling you, not leaking it.
Can I ignore it for an old account?
Only if no other account uses the same password. Otherwise change it everywhere.
Where does this come from?
- CISA, Use Strong Passwordscisa.govRead 16 October 2026
- Google Account Help, Change compromised passwords in your Google Accountsupport.google.comRead 16 October 2026
Is your email address in a public breach?
Enter one address. We look it up in monitored breach databases and show which breaches list it and what each exposed.