Webcomic xkcd does an excellent job of explaining the “Heartbleed” bug:
If you know something about programming this is bug is the result of dynamic memory and lack of bounds checking. It allows the server to return the contents of RAM that may include information like passwords, login ids, etc. that are normally not visible externally. If you’ve recently logged in your information could easily still be in RAM and vulnerable but if you haven’t it’s likely nothing of yours remains. It’s all dependent on whether or not someone has determined a particular server is vulnerable and exploited the bug.
So what should you do? First, check this list on Mashable. If there’s a site you use frequently and it’s marked as vulnerable, change your password now. Otherwise, you can probably take your time but still change it. Consider using a password manager like 1Password or LastPass to make creating and managing passwords easier. Turn on multi-factor authentication where available. Also consider a personal password expiration policy. Yes, I know it’s a pain but if you use a password manager generating a new password is painless.
Security isn’t a “set it and forget it” thing, it’s an ongoing process.