Your password is already out there#
If you have used the internet for more than five years, statistically at least one of your passwords has appeared in a public breach dump. That's not paranoia — it's arithmetic. Roughly 12 billion credential pairs have been leaked into searchable databases by 2025.
Understanding how this happens makes the defensive moves obvious.
The supply chain of a leaked password#
A password rarely leaks because you made a mistake. It leaks because a company that stored it did. The path is usually:
- Database breach. An attacker exploits a vulnerability in a service's website or backend (SQL injection, exposed admin panel, misconfigured cloud storage, insider).
- Hash extraction. They walk away with a table of (email, password-hash) rows. Sometimes — increasingly rarely, but it happens — passwords are stored in cleartext.
- Cracking. Even hashed passwords get cracked offline. Short or common passwords fall in seconds against modern GPUs.
- Resale on credential markets. Cracked pairs are sold in bundles on dark-web forums and Telegram channels. Prices have collapsed — a million pairs costs single-digit dollars.
- Credential stuffing. Buyers run those pairs against hundreds of other sites — your bank, your email, your work portal. Because most people reuse passwords, a single leak from a small service compromises accounts everywhere.
The two failure modes you control#
You cannot stop a service from getting breached. But you can prevent the credential-stuffing step from working:
- Reuse. If your password is unique to one site, a leak from that site can't reach any other.
- Strength. If your password is long and random, even an offline crack takes years per password — long enough that the bundle moves on to easier targets.
Both of these are essentially solved by a password manager.
Check whether you're already exposed#
- haveibeenpwned.com — type your email; it returns every breach your address has appeared in, going back over a decade.
- Pwned Passwords (same site) — type a password; it tells you how many breach dumps it appears in. Yes, your one beloved password is probably already in a dozen.
- Most password managers now run this check automatically against your vault and flag every reused or breached entry.
If an email of yours appears in a breach: the email itself can't be changed, but you can be certain that breach will fuel phishing aimed at you. Expect more, look more carefully.