Is my password out there?

Check, in this order

1. Every email address you own at haveibeenpwned.com. Old addresses too — they're often the recovery address on an account you forgot about.
2. Your password manager's breach report. Bitwarden, 1Password, Chrome, Safari, and Firefox all have one built in. This is better than any external check, because it compares your actual passwords against known leaks.
3. Reused passwords. Same tool, different report. Reuse is what turns one breach into ten compromised accounts.
4. Your own name and handles in a search engine, in quotes. Try your username, phone number, and email — usernames are the strongest link between accounts you think are separate.
5. Your phone number. If it's tied to your email and public somewhere, you're exposed to SIM-swap attacks against SMS 2FA.

Fix in this order

1. Email first. It resets everything else. New unique password, then 2FA.
2. Your password manager's master password. Long passphrase, never reused, never typed into anything else.
3. Banking and payments. Then add 2FA.
4. Anything sharing the breached password. Your manager will list them.
5. Move 2FA off SMS for anything that matters. App or hardware key.
6. Delete accounts you don't use. An unused account is a breach waiting to happen, and it still holds your data.

Keeping private information from resurfacing

• Use email aliases for new signups. When one leaks you know exactly who leaked it, and you can kill the alias without changing your real address.
• Stop answering security questions honestly. Store random strings in your manager instead — a real answer is researchable.
• Never paste secrets into search boxes, notes apps, or a chatbot. Anything that syncs is a copy you no longer control.
• Check what you publish. Screenshots leak email addresses, photos of a badge leak an employer, and a window in the background leaks a location.
• Scrub your public repositories. If you write code, an API key committed once stays in the git history even after you delete the line.
• Set a yearly reminder to repeat the checks above. New breaches land constantly.