Is my Gmail account hacked? How to check and fix it
2 min read · Updated October 15, 2026
Open your Google Account’s security page and review recent security activity and signed-in devices. In Gmail, check Settings for unknown forwarding addresses and filters, and use the ‘last account activity’ details at the bottom of the inbox. If anything looks wrong, change your password, sign out everywhere and turn on 2-Step Verification.
Signs your Gmail may be compromised
- ✓Sent messages you did not write.
- ✓Security alerts from Google about a new sign-in you do not recognise.
- ✓Password reset emails for other services that you did not request.
- ✓Unknown devices or locations in your account’s device list.
- ✓Contacts reporting strange mail from your address.
Where to look in your Google Account
Visit the Security section of your Google Account. It lists the devices that have signed in, recent security activity and the services connected to your account. In the Gmail inbox on a computer, the activity details link at the bottom shows recent access to your mailbox.
- ✓Recent security activity and ‘Your devices’: remove anything unfamiliar.
- ✓Third-party apps with account access: remove ones you do not use.
- ✓Gmail settings: check Forwarding, Filters and Blocked Addresses for entries you did not create.
- ✓Recovery email and phone: confirm they are yours.
Check your email address for known leaks
Works with any provider. Enter your address, get a free exposure check, and see what to fix first.
Secure the account
Change your password to a unique one, sign out of other devices and turn on 2-Step Verification. Where available, set up a passkey for faster, phishing-resistant sign-in. Run Google’s security checkup to review everything in one place.
Was your Gmail address in a leak?
Gmail accounts are hacked most often through reused passwords and phishing, not because Gmail itself was broken into. A breach check shows whether your address appears in known leaks so you know whether to treat old passwords as compromised.
Gmail security checklist
- 1Check recent security activity and signed-in devices in your Google Account.
- 2Remove unknown devices and third-party app access.
- 3Review Gmail forwarding, filters and blocked addresses.
- 4Set a new unique password and sign out everywhere.
- 5Turn on 2-Step Verification and consider adding a passkey.
- 6Verify recovery email and phone number.
- 7Check your address for breaches.
Frequently asked questions
Can someone hack my Gmail with just my email address?+
No. They need your password, a stolen session or a successful phishing attack. Your address alone is not enough.
Will Google tell me if someone logs in?+
Google commonly sends alerts for sign-ins from new devices, but check your account’s activity page rather than relying on emails alone.
What if I cannot sign in?+
Use Google’s official account recovery page and have a device or recovery method you used before.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.