My password leaked. How bad is it?

The one question

A leaked password for one throwaway forum, used nowhere else, is nearly nothing. That same password reused across your email, bank, and shopping is a master key in criminal hands — automated tools try leaked pairs against hundreds of major sites within days.

The triage

1. Change it at your email first, even if the leak was elsewhere — everything resets through email.
2. Change everywhere it was reused. Be honest with yourself about where.
3. Make replacements you never reuse. Three unrelated words beat "Password2026!" by a mile — or let a password manager remember for you.
4. Two-step sign-in on email and bank, so a future leak of a password alone is not enough.

Signs someone already used it

Password-reset emails you did not request, "new sign-in" alerts from odd places, friends receiving strange messages "from you," or an inbox where things mark themselves read. Any of those: change the email password from a device you trust, right now, then check the account's forwarding rules.