Integrates with the HaveIBeenPwned Pwned Passwords API to detect and block passwords that have been exposed in known data breaches.
Getting an API Key
- Visit https://haveibeenpwned.com/API/Key.
- Subscribe to a plan and enter your email address to receive an API key.
- Paste the API key into the API Key field below.
Settings
- Enabled
- Activates breach checking when users set a new password. Enabled by default.
- Logon Check
- When enabled, the user's current password is checked according to the threshold below. If it has been compromised since last checked, the user is prompted to change it. Enabled by default.
- Check Threshold Days
- For logon checks: only re-query the API if the last check was more than this many days ago. Default is 7 days. Reduces API usage for frequently logging-in users.
- API Key
- Your HaveIBeenPwned API key. Stored encrypted at rest.
- Password Breached Message
- Message shown to users when their new password is found in breach data. Customise to match your security policy.
- New Password Breach Message
- Message shown when a newly set password (during a password change) has been breached.
The platform uses the k-Anonymity model when calling the Pwned Passwords API — only the first 5 characters of a SHA-1 hash are sent to the API, so actual passwords are never transmitted.
Get HaveIBeenPwned API Key