Change Compromised Passwords: When & How

Updated 5 November 2026 · Standard formula, shown below

Yes, you should change a compromised password immediately, and you should do it before doing anything else on that account. If a password has been exposed in a data breach, leaked, or shared, it is no longer a secret, and any account it protects is at risk of unauthorized access. This article explains how to recognize a compromised password, how to change it correctly, and how to prevent future compromises.

How Passwords Get Compromised

A password is considered compromised when it is no longer known only to you. The most common ways this happens are:

Data breaches: A website or service you use suffers a security incident and its user database, including password hashes or plaintext passwords, is stolen.
Phishing: You enter your password on a fake login page that looks legitimate but is controlled by an attacker.
Malware: Keyloggers or spyware on your device record your keystrokes or steal saved passwords from your browser.
Reuse: You use the same password on multiple sites. If one site is breached, attackers try that password on other sites like email, banking, and social media.
Social engineering: Someone tricks you into revealing your password over the phone or in person.

If you suspect any of these have happened, treat the password as compromised. Even a suspicion is enough reason to change it.

Signs Your Password Has Been Compromised

Sometimes you won’t know until something goes wrong. Look for these signs:

You receive a password reset email you didn’t request.
You see login attempts from unfamiliar locations or devices in your account activity log.
Your account settings, email forwarding rules, or recovery options have been changed without your action.
You find messages sent from your account that you didn’t write.
A breach notification service (like Have I Been Pwned) tells you your email address appeared in a breach.
You accidentally typed your password into a suspicious link or website.

If any of these happen, change your password immediately and sign out of all other sessions.

How to Change a Compromised Password

Follow these steps in order:

Use a secure device. If you suspect malware, run a security scan before changing passwords. If you can, use a different trusted device.
Go directly to the website. Don’t click links in emails or messages. Type the official address into your browser or use a bookmark.
Sign in and go to settings. Look for “Security,” “Password,” or “Login” options.
Choose a strong new password. It should be long (at least 12 characters), unique, and not based on personal information. Use a passphrase of random words or a password manager’s generator.
Save the change. Some sites will ask you to re-enter your current password first. Others may log you out of all other devices.
Update your password manager. If you use one, replace the old entry.
Change the same password on any other site where you reused it. This is critical; otherwise, attackers will use the compromised password to break into those accounts.

After changing the password, check the account’s recovery options (email, phone number, security questions) to ensure they haven’t been altered.

How to Choose a New Strong Password

A strong password is one that is difficult for both humans and computers to guess. The current best practice is to use a long passphrase made of random words, or a random string of characters generated by a password manager. For example:

Weak: P@ssw0rd123, qwerty, iloveyou, yourname+year
Strong: correct-horse-battery-staple, 7#kLm!2@xQ9$pR, blue-turtle-sunset-42

Do not use the same password on multiple accounts. If one site is breached, all your other accounts with that password are at risk. A password manager can generate and store unique passwords for every site, so you only need to remember one master password.

Should You Change Passwords Regularly?

For a long time, experts recommended changing passwords every 30, 60, or 90 days. That advice has changed. Today, the consensus is that frequent forced password changes are not necessary and can actually lead to weaker passwords, because people tend to make small variations (like adding a number at the end) that are easy to guess.

Instead of changing on a schedule, you should change a password only when there is a reason to believe it has been compromised. That reason could be a data breach notification, a phishing attempt, or suspicious activity on your account. If you use unique, strong passwords and enable multi-factor authentication, you don’t need to change them regularly.

What to Do After Changing the Password

Changing the password is the first step, but not the only one. Take these additional actions to secure the account:

Enable multi-factor authentication (MFA). This adds a second check (like a code from an app or a text message) that an attacker won’t have, even if they know your password.
Review active sessions. Many services let you see which devices are logged in. Sign out of any you don’t recognize.
Check account recovery options. Ensure your email address, phone number, and security questions are still yours.
Watch for suspicious activity. For the next few weeks, check your account activity and be alert for emails or messages you didn’t send.
Consider a credit freeze or fraud alert if financial information was involved. This is only necessary if the compromised account contained sensitive financial data, such as a bank or credit card.

Common Mistakes to Avoid

Reusing the new password. If you use the same new password on another site, you’ve recreated the original problem.
Changing only one account. If you reused the compromised password anywhere else, change it there too.
Using an insecure device. Changing a password on a malware-infected computer may just give the attacker the new password.
Falling for follow-up phishing. After a breach, attackers often send fake “reset your password” emails. Always go directly to the site yourself.
Ignoring multi-factor authentication. A strong password alone is not enough for high-value accounts like email and banking.

Frequently Asked Questions

How do I know if my password was in a data breach?
You can check your email address on a breach notification service like Have I Been Pwned. It will show you which known breaches include your email. If your password was reused on those sites, consider it compromised.

Should I change my password if I get a breach notification?
Yes. Even if the breach only exposed email addresses, it’s safer to change the password for that site, especially if you reused the password elsewhere. Many breaches expose password hashes that can be cracked.

What if I can’t log in to change my password?
Use the “Forgot password” or “Reset password” link on the login page. This will send a reset link to your recovery email or phone. If you don’t have access to those, contact the site’s support team and be prepared to verify your identity.

Is it safe to use a password manager?
Yes. Password managers are widely recommended by security experts. They generate and store strong, unique passwords for each site, so you only need to remember one master password. The risk of a password manager being compromised is much lower than the risk of password reuse.

How long does it take an attacker to crack a compromised password?
It depends on the password’s length and complexity. A short, simple password can be cracked in seconds or minutes. A long, random password could take centuries. If your password was hashed with a weak algorithm, cracking is faster. That’s why you should change it immediately.

What is the difference between a compromised password and a weak password?
A weak password is one that is easy to guess, like “123456” or “password.” A compromised password is one that has been exposed, regardless of its strength. A strong password that was used on a breached site is still compromised and must be changed.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.