Have I Been Pwned (haveibeenpwned.com) is a site where you type in an email address and see which known data breaches included it. Troy Hunt, a security speaker and blogger, created it and has run it since 2013. The site says it grew out of the Adobe breach, after Hunt noticed the same accounts, often with the same passwords, exposed repeatedly.
What it does
Public search. It returns results for one email address at a time. The site's FAQ calls the public search a free service for people to judge whether their account was caught up in a breach.
Alerts. You can sign up to be told if an address appears in a future breach. You verify the address by email first, and alerts go only to the address you monitor.
Hidden breaches. Some breaches are marked sensitive and do not show in a public search. If you sign in to the dashboard as the verified owner of an address, you can see them under Breaches.
Pwned Passwords. A separate tool checks whether a password has appeared in a breach. The site says the password is hashed and anonymised before it is sent, so a search does not send your full password in usable form.
What it misses
The site says it holds "a small subset" of all the records that have been breached. A search that finds nothing does not mean you were never affected. Recent breaches, including Florida's, may or may not be in the data.
What to do with a result
If a site shows up, change that password and any other account that reuses it. The site says a password found in Pwned Passwords should no longer be used.
Sign up for alerts on the addresses you use most.
Check the dashboard for sensitive breaches on addresses you own.
Freeze your credit if a breach included Social Security numbers. Friday's issue last week showed how.
Up next · Friday
The IRS Identity Protection PIN: a six-digit number that blocks someone else from filing a tax return with your Social Security number, and how to get one.