AltF Security

What to do after a data breach

Work out what was exposed, then act on that: change the breached password everywhere you reused it, turn on two-factor authentication, watch your bank and card statements, and expect targeted phishing that quotes your real details. Use the password check below to see whether a password is already in public breach lists - privately, without sending it.

  • Free, no sign-up
  • Passwords never leave your browser
  • No fake scans or scores
  • Works on mobile

Match the action to what leaked

  • Password (even hashed): change it on that site and on every site where you used it. Turn on 2FA.
  • Email address: expect phishing that mentions the breached service. Consider an alias for that account.
  • Phone number: expect scam calls and SMS. Never share OTPs; turn on your carrier's SIM protection.
  • Card number: ask the bank for a new card and review statements for small test charges.
  • Aadhaar, PAN or ID numbers: lock Aadhaar biometrics on the UIDAI site, and check your credit report for loans you did not take.
  • Address and date of birth: these power identity scams; be wary of 'verification' calls.

Follow-up scams to expect

Breaches are followed by messages that use your real name, order history or partial card number to seem genuine, often offering a refund or 'security check'. Treat any contact about the breach as suspicious and go to the company's site or app directly.

Password check

See how strong a password is and whether it appears in known data breaches. It is hashed in your browser; only 5 characters of the hash are sent.

Results appear as you type. Nothing is sent until you press Check breaches.

Strength is calculated on this page. The breach check uses Have I Been Pwned's k-anonymity range API with padding, so the password and its full hash never leave your browser. Nothing is stored.

What to do after a data breach: questions and answers

How do I know if I was in a data breach?

Companies usually email affected users. You can also check your email address at haveibeenpwned.com and your passwords privately with the check on this page.

Do I need to change my password if it was hashed?

Yes. Weak and common passwords are cracked from hashes quickly, and you cannot know how strong the company's hashing was.

Should I freeze my credit?

If ID numbers or financial details leaked, check your credit report with a bureau and, where your country allows it, place a freeze or fraud alert.

Can I get compensation for a data breach?

It depends on local law and the company. In India the DPDP Act gives you rights to information and grievance redress; keep the breach notice and any losses documented.

Start from what happened

Security checks and guides

Full security check-upAll six tools, the tool directory and how each check works.Password leak checkerCheck if your password appears in known data breaches without sending it, plus a strength score and crack-time estimate. Free, private, k-anonymity based.Passphrase generatorGenerate random passphrases and passwords with your browser's secure random number generator. See the entropy of each one. Free, offline-capable, nothing stored.Phishing link checkerCheck a suspicious link for phishing tricks before you click: lookalike domains, fake bank and UPI links, punycode, hidden redirects. The link is never opened.Website security checkTest any website's security headers (HSTS, CSP, X-Frame-Options, cookies and more), get a grade and copy the exact fix. Plus a private page code audit.Personal security checkupTake a free 24-point personal security checkup covering passwords, 2FA, devices, scams, privacy and home Wi-Fi. Get a score and your highest-impact next step.Hacked account recoveryYour email, Instagram, WhatsApp or bank account was hacked? Follow these recovery steps in order, secure your email first, and know where to report fraud in India.

88 more free security and privacy tools

Focused tools for one job each, grouped by what you are trying to do. All run in your browser unless the tool says otherwise.

Passwords and sign-in

Create, test and manage the credentials that guard everything else.

Scams and phishing

Spot tricks in messages, links, QR codes and calls before they cost you.

When something goes wrong

Step-by-step help after a hack, a breach, a lost phone or a card fraud.

Devices and home network

Harden phones, computers, routers and smart devices.

See all 88 tools

AltFTool stores no passwords, links or results. Only the website check uses AltFTool's server, to read headers, and it keeps nothing.