Block leaked passwords at sign-up
A check in your sign-up and password-change forms that rejects passwords already exposed in data breaches, without ever sending the password anywhere.
For your agent: agent.md
Parts
Steps
- Hash the password with SHA-1 on your server and send only the first five characters of the hash to the Pwned Passwords range API (no key).
- Compare the returned hash suffixes with the rest of your hash; a match means the password has been seen in a breach.
- Reject it with a clear message, and combine the check with a strength meter.
Watch out
- Send a User-Agent header; Pwned Passwords data is CC BY 4.0, so credit Have I Been Pwned with a link.
- Looking up e-mail addresses (not passwords) is a different API that needs a paid key.