If you’ve been online in the last few days, you’ve probably seen the headlines: over 16 billion login credentials have been exposed in what researchers are calling one of the largest data leaks ever compiled. These credentials come from past breaches, malware infections, and other data thefts, all rolled into one massive dump now circulating among cybercriminals.
This isn’t about one company or one site getting hacked. The leaked data includes logins for services millions of people use every day—Google, Apple, Facebook, Telegram, GitHub, and more. Even some government portals and VPN providers are potentially impacted. Whether or not your credentials are in the leak, this is a wake-up call for everyone. Now is the time to act. And with Enpass, you can do that confidently, without giving up control of your data.
What happened and why it matters
Security researchers uncovered a trove of credentials that combine billions of usernames and passwords from past data breaches and malware attacks, including infostealers. These credentials are actively traded and used for cybercrimes like account takeovers, phishing, and identity theft.
Even older leaks can be dangerous. Many people reuse the same or similar passwords across accounts. That means a breach from years ago can still lead to new compromises if you’ve used that password elsewhere.
How to protect yourself now (and how Enpass helps)
The good news is you can take action today. Here’s how:
1. Check if your accounts are affected
Use services like Have I Been Pwned to check if your email appears in known breaches. If you use Enpass, the breach monitoring feature checks your stored credentials against public breach data—and it does this privately, on your device. No data leaves your hands.
2. Change compromised or reused passwords
If you find any affected accounts under Compromised or Identical section in Password Audit of Enpass, update those passwords right away. You can create new passwords with built-in password generator in Enpass. Create strong, unique passwords and use autofill to save time when updating logins.
3. Conduct a full Password Audit
With just a few clicks, Enpass will show you:
- Weak passwords
- Reused passwords
- Old passwords
- Passwords found in public breaches
- Passkey supported websites and apps
- 2FA supported websites and apps
You get a complete view of your vault’s health and can fix problems one by one.
4. Use passkeys on passkey-supported websites and apps
Passkeys are a modern, phishing-resistant alternative to passwords. On websites and apps that support passkeys, opt to sign in with passkeys instead of traditional credentials. Enpass supports storing and managing passkeys securely, making logins faster and safer.
5. Enable TOTP-based 2FA
Don’t stop at passwords. Add a second layer of protection using 2FA. Enpass includes a TOTP generator that can store and autofill your 2FA codes alongside your passwords. That means fewer apps to manage, and one secure place for everything.
Why choose Enpass for this moment
What makes Enpass different is what it doesn’t do:
- It doesn’t store your vault on its own servers.
- It doesn’t analyze your data or track your usage.
- It doesn’t force you into a vendor-controlled ecosystem.
Instead, Enpass gives you:
- Local breach detection: All checks happen on your device, not in the cloud
- Your choice of storage: Keep your vault in iCloud, Google Drive, Dropbox, OneDrive, Box, Nextcloud, or local storage
- Passkey storage: Store and manage your passkeys, all within the Enpass app
- TOTP-based 2FA: Built-in generation and autofill of one-time codes
- True zero-knowledge design: Enpass never sees your data, ever
Whether you’re securing personal accounts or managing credentials across a team, Enpass puts you in control.
Don’t wait for a breach to become a crisis
Leaks like this won’t stop. But the damage they cause can be prevented. You don’t need to overhaul your digital life, you just need to take smart steps, and Enpass is built to help you do exactly that.