Go to haveibeenpwned.com and enter your email. If it shows up in a breach (e.g., Naz.API, Collection #1), assume your password is public.
Here is the reality check:
Even if a server contains a stolen Facebook database, it will not contain a simple passwords.txt . Any competent hacker or platform stores passwords using bcrypt , SHA-256 , or salting . The text you would find looks like this: user@example.com:$2y$10$N9qo8uLOickgx2ZMRZoMy.Mr/.cZxRr8KcY8oQ Index Of Password Txt Facebookl