Here's the problem: unless a website notifies you that they had a problem and they fixed it, or posts that information on its site, you don't know: (1) Do I need to update my password?<br> (2) Is it safe to update my password yet (or is the site still vulnerable)? So unfortunately there's no general yes/no answer to your question. If you use Mozilla's "Persona" service to log in to sites, or the "new" sync service where you create a "Firefox Account", there is a blog post with options and recommendations here: https://blog.mozilla.org/security/2014/04/08/heartbleed-security-advisory/