What “Pwned” Means & How To Protect Your Email From Getting Hacked

Key Takeaways

• "Pwned" means your email address, password, or other personal data was exposed in a data breach. It doesn't necessarily mean someone has accessed your account.
• Have I Been Pwned is a free, legitimate breach search service created by security researcher Troy Hunt. Privacy Monitor from Clean Email checks your address continuously, so you don't have to repeat manual searches.
• If you've been pwned, change exposed or reused passwords, enable two-factor authentication (2FA), and review your account activity and Sent folder.
• To prevent it, use unique passwords stored in a password manager, close accounts you no longer use, and keep your real address off sites you don't trust.

What Does "Pwned" Mean?

"Pwned" is gaming slang for "owned," meaning dominated or defeated. In cybersecurity, being pwned means your email address, password, or other personal data was exposed in a data breach, so attackers may possess your information even if no one has logged into your account yet.

What Happens if You've Been Pwned?

Once your data is exposed, especially passwords, it can be used for:

• Unauthorized account access: Attackers try your leaked credentials on email, social media, banking, and shopping accounts.
• Phishing and spam: Breached addresses are sold and shared, which often leads to more phishing emails and scam messages.
• Spear-phishing: Details from the breach are used to craft targeted messages that are hard to spot.
• Identity theft: With access to your inbox, attackers can reset passwords for your other accounts.
• Financial fraud: If payment data was exposed, it can lead to unauthorized purchases or fraudulent credit applications.

For how breaches happen and what data they typically expose, see our guide to email data breaches.

How to Check If You've Been Pwned

You can run a one-time check on Have I Been Pwned or set up ongoing monitoring with Clean Email's Privacy Monitor.

Have I Been Pwned

Have I Been Pwned (HIBP) is a free breach search service launched in December 2013 by Australian security researcher Troy Hunt. It collects data from verified breaches and lets anyone check whether an email address appears in them. As of September 2026, it covers more than 17.8 billion breached accounts from over 1,000 websites.

1. Go to haveibeenpwned.com.
2. Enter your email address and click Check.
3. Review the results. Each breach listed shows the affected service, when the breach happened, and which types of data were exposed.

HIBP also offers:

• Pwned Passwords: Checks whether a password has appeared in a breach. The password is hashed on your device and only the first five characters of the hash are sent, so your full password never leaves your device.
• Notify Me: Free email alerts when your address appears in a future breach.
• HIBP 2.0: A redesign launched in May 2025 that added dedicated breach pages with remediation advice and a unified dashboard for verified users. Username and phone number searches were removed.

Is it legit? Yes. HIBP is used by security teams and government agencies worldwide. It doesn't log the addresses you search, verifies breaches before adding them, and shows results from sensitive breaches (such as adult sites) only after you verify you own the address.

What to Do if You've Been Pwned or Hacked

Warning signs of a compromised account include password reset emails you didn't request, messages in your Sent folder you didn't write, contacts receiving spam from your address, sign-ins from unfamiliar locations, and unexpected changes to account settings.

If your email was exposed or you see any of these signs, do the following right away:

1. Change compromised and reused passwords. Start with your email account and make the change from a device you know is free of malware. Then update every account that shared the same password.
2. Enable two-factor authentication (2FA). A code from an authenticator app or your phone stops attackers who only have your password. Use passkeys where available.
3. Check account activity and your Sent folder. Sign out of sessions you don't recognize, remove unfamiliar connected apps, and look for messages you didn't send. Attackers often use hijacked accounts to phish your contacts.

➡️ For the full recovery process, including securing recovery options and connected accounts, see our post-hack recovery guide.

➡️ To understand what a specific breach exposed and how to respond, read about email data breaches.

➡️ If spam appears to come from your own address, see how to stop spam emails from your own email address.

How to Reduce the Risk of Being Pwned Again

• Never reuse passwords. When one service is breached, attackers try the same password everywhere else. A password manager generates and stores unique passwords for you: compare options in our best password managers guide and learn how to spot compromised passwords.
• Close old accounts you no longer use. Every forgotten account is a potential entry point for hackers. Learn what a digital footprint is and how to reduce it.
• Clean up subscriptions. Clean Email's Unsubscriber shows every mailing list in your inbox in one view, so you can drop services you no longer use and spot old accounts worth closing.

• Hide your real address. Apple's Hide My Email (part of iCloud+) creates random forwarding addresses for sign-ups that you can deactivate if a service is breached or starts sending spam. See our Hide My Email guide for setup steps.

Final Thoughts

Being pwned means your data is out there, not that your account is lost. Check your address on Have I Been Pwned, turn on ongoing monitoring with Privacy Monitor, and act on the three urgent steps above as soon as a breach shows up.