How to check breached passwords in password manager
Knowing how to check breached passwords in password manager tools can help you spot exposed credentials before attackers use them.
Most modern password managers compare your saved logins against known breach data, then flag risky passwords so you can replace them quickly.
What a breached password check actually does
A breached password check scans your stored credentials for matches against databases of leaked usernames and passwords.
Reputable password managers use services such as Have I Been Pwned, encrypted local analysis, or private breach monitoring systems to identify passwords that may have been exposed in a data breach.
The goal is not just to find passwords that were stolen directly from a website.
It is also to detect reused passwords, old passwords, and credentials that appear in credential stuffing lists used by attackers.
Common risk signals password managers look for
- Password found in a known data breach
- Password reused across multiple accounts
- Password is weak or easy to guess
- Password has not been changed for a long time
- Account login appears exposed on the dark web or breach feeds
How to check breached passwords in password manager tools
The exact steps vary by product, but the process is similar in most password managers such as 1Password, Bitwarden, LastPass, Dashlane, Keeper, and NordPass.
You typically open the security or audit section, run a password health scan, and review the accounts marked as compromised.
General steps that work in most password managers
- Open your password manager app or browser extension.
- Go to the security dashboard, password health, or audit report.
- Look for categories such as compromised, reused, weak, or old passwords.
- Review each flagged account and confirm the saved login details.
- Update the password for any account marked as breached.
- Turn on alerts or breach monitoring if the feature is available.
If your password manager supports automatic breach monitoring, it may send an alert when a stored login appears in a known leak.
Some tools require you to manually start a scan, while others check continuously in the background.
How breach monitoring differs from password health checks
These features are often grouped together, but they are not identical.
A password health check evaluates the quality of your saved passwords, while breach monitoring checks whether those credentials have appeared in a public or verified breach.
- Password health: Finds weak, reused, and old passwords
- Breach monitoring: Detects exposed passwords and compromised accounts
- Security score: Combines several risk signals into one summary
Using both features gives you a clearer view of your account security.
A strong password can still be compromised if it was reused or leaked from a third-party service.
Which password managers offer breach checking?
Most leading password managers include some form of breached password detection.
The feature name may differ, but the purpose is usually the same: help you find exposed credentials before criminals can exploit them.
Examples of common feature names
- Watchtower
- Security Dashboard
- Password Health
- Security Audit
- Compromised Passwords
- Dark web monitoring
Some password managers run checks locally on your device using encrypted hashes, while others rely on cloud-based monitoring.
If privacy matters to you, review how the vendor handles hashing, encryption, and breach data before enabling the feature.
What to do when a password is flagged as breached
Once you find a compromised password, replace it immediately.
If the same password is used anywhere else, change those accounts too, because reused credentials are a major reason account takeovers succeed.
Prioritize these accounts first
- Email accounts
- Banking and payment apps
- Cloud storage and work accounts
- Social media profiles
- Shopping and subscription services
Email should come first because it is often the recovery channel for other accounts.
If attackers access your inbox, they can reset passwords elsewhere and lock you out of more services.
Use the password manager to fix the issue
- Generate a new password with at least 14 characters
- Use a unique password for every account
- Store the updated password in your manager right away
- Enable multi-factor authentication, preferably with an authenticator app or security key
How to check breached passwords in password manager on desktop and mobile
On desktop apps, breach checks are usually easier to review because dashboards and filters are more visible.
On mobile, the feature is often available under Security, Audit, or Tools, though some apps require a desktop login to view full reports.
Desktop app workflow
- Open the app or browser extension
- Select the security report
- Filter for compromised logins
- Open each item to view the affected site
- Change the password and save it
Mobile app workflow
- Open the password manager app
- Tap the security section
- Review warnings and alerts
- Jump into the affected account and update the password
- Confirm the app saved the new credential
If your app syncs across devices, make sure the updated password appears everywhere before logging out of the old session.
How to confirm a password was really exposed
Not every warning means someone actively targeted your account.
Sometimes a password is marked breached because it appears in a large data set from an old leak, even if there is no sign of misuse yet.
To assess the risk, check whether the same password was reused, whether the affected account has been accessed unexpectedly, and whether the service offers login history or recent activity logs.
If you see unfamiliar logins, treat it as a priority incident.
Best practices to reduce future breach risk
Checking breached passwords is only part of account protection.
Strong password hygiene and layered security reduce the chance that a single leak turns into multiple account compromises.
- Use a unique random password for every account
- Turn on multi-factor authentication wherever available
- Prefer password manager-generated passwords over memorized ones
- Review password health reports monthly
- Remove old or unused accounts you no longer need
- Keep recovery email and phone details current
Security experts from organizations like CISA and NIST recommend strong, unique credentials and modern authentication methods because password reuse remains one of the most common attack paths.
When to change all passwords instead of one
Changing only the flagged password is usually enough when the breach is limited to one service and you never reused the credential.
However, you should consider broader changes if the password was used in multiple places, if your email account was exposed, or if the breach involved a service with sensitive data.
In high-risk cases, update your email, financial, and recovery-account passwords first, then move through the rest of your vault in order of importance.
How often should you run a breached password check?
Run a password health or breach scan at least once a month, and review alerts as soon as they appear.
If your password manager offers continuous monitoring, enable it so you are notified when a new breach affects one of your saved logins.
Regular checks are especially important after major breach events, because compromised credentials are often circulated quickly across criminal marketplaces and used in automated login attacks.
Choosing a password manager with strong breach detection
If breach checking matters to you, look for a password manager with clear security reporting, fast alerts, and transparent privacy controls.
Good features to evaluate include encrypted storage, zero-knowledge architecture, password health scoring, multi-factor authentication support, and easy password generation.
A reliable password manager should make it simple to find exposed credentials, change them quickly, and keep your vault organized as your account list grows.