AltF Security

What to do if your account is hacked

Act in this order: secure the email account that can reset everything else, sign out every other session, change the password to a new unique one, turn on two-factor authentication, then recover or lock the other accounts. If money is involved, call your bank first - in India, also call the 1930 cybercrime helpline within the first hours, when frozen funds are most likely to be recovered.

  • Free, no sign-up
  • Passwords never leave your browser
  • No fake scans or scores
  • Works on mobile

The first hour, in order

  • If money was taken: call your bank to block cards and UPI, then call 1930 (India) or your national fraud line.
  • From a clean device, change your email password and choose 'sign out of all sessions'.
  • Check your email's recovery phone, recovery email, forwarding rules and filters - attackers add their own.
  • Turn on two-factor authentication with an authenticator app or passkey.
  • Use the email to reset passwords on your bank, social and shopping accounts, newest password first.
  • Tell your contacts not to trust messages sent from your account in the last few days.

Recovering specific accounts

  • Google: g.co/recover, then review Security > Your devices and Third-party access.
  • Microsoft: account.live.com/acsr for the recovery form.
  • Instagram and Facebook: use 'Need more help?' on the login screen and follow the identity check.
  • WhatsApp: re-register your number to log the attacker out, then set a two-step verification PIN.
  • UPI apps: call the app's helpline and your bank, and change your UPI PIN after blocking.

Collect evidence before you clean up

Take screenshots of unknown logins, messages sent in your name, transaction IDs and the attacker's contact details before deleting anything. A dated evidence pack makes police complaints and bank disputes far easier.

Password check

See how strong a password is and whether it appears in known data breaches. It is hashed in your browser; only 5 characters of the hash are sent.

Results appear as you type. Nothing is sent until you press Check breaches.

Strength is calculated on this page. The breach check uses Have I Been Pwned's k-anonymity range API with padding, so the password and its full hash never leave your browser. Nothing is stored.

What to do if your account is hacked: questions and answers

What should I secure first after a hack?

Your main email account, because it can reset the password of almost every other account. Then banking and payment apps, then social media.

How do I report cyber fraud in India?

Call the national cybercrime helpline 1930 as soon as possible and file a complaint at cybercrime.gov.in. Keep transaction IDs, screenshots and the fraudster's numbers ready.

The hacker changed my recovery email and phone. Can I still recover?

Usually, yes. Use the provider's account recovery form from a device and location you have used before, and answer with as much history as you can - old passwords, when you created the account and frequent contacts.

Should I factory reset my phone after a hack?

Only if you installed something suspicious, granted remote access or see unknown apps. Back up your data first, then reset and reinstall apps from the official store.

How do I stop it happening again?

Give every account a unique password from a password manager, turn on two-factor authentication everywhere it is offered, and never share OTPs. The personal security checkup lists the rest.

Start from what happened

Security checks and guides

Full security check-upAll six tools, the tool directory and how each check works.Password leak checkerCheck if your password appears in known data breaches without sending it, plus a strength score and crack-time estimate. Free, private, k-anonymity based.Passphrase generatorGenerate random passphrases and passwords with your browser's secure random number generator. See the entropy of each one. Free, offline-capable, nothing stored.Phishing link checkerCheck a suspicious link for phishing tricks before you click: lookalike domains, fake bank and UPI links, punycode, hidden redirects. The link is never opened.Website security checkTest any website's security headers (HSTS, CSP, X-Frame-Options, cookies and more), get a grade and copy the exact fix. Plus a private page code audit.Personal security checkupTake a free 24-point personal security checkup covering passwords, 2FA, devices, scams, privacy and home Wi-Fi. Get a score and your highest-impact next step.Data breach responseGot a data breach email or saw your service in the news? Find out what was exposed, which passwords to change, and how to avoid follow-up scams.

88 more free security and privacy tools

Focused tools for one job each, grouped by what you are trying to do. All run in your browser unless the tool says otherwise.

Passwords and sign-in

Create, test and manage the credentials that guard everything else.

Scams and phishing

Spot tricks in messages, links, QR codes and calls before they cost you.

When something goes wrong

Step-by-step help after a hack, a breach, a lost phone or a card fraud.

Devices and home network

Harden phones, computers, routers and smart devices.

See all 88 tools

AltFTool stores no passwords, links or results. Only the website check uses AltFTool's server, to read headers, and it keeps nothing.