# Block leaked passwords at sign-up

A check in your sign-up and password-change forms that rejects passwords already exposed in data breaches, without ever sending the password anywhere.

## Parts

- Data: [Have I Been Pwned](https://agentgid.com/resources/have-i-been-pwned/agent.md): A breach lookup service: enter an email address or domain to see which known data breaches exposed it, plus a separate Pwned Passwords service that tells you if a password has appeared in leaks.
- Auth library: [Better Auth](https://agentgid.com/tools/better-auth/agent.md)
- Strength meter: [zxcvbn-ts](https://agentgid.com/tools/zxcvbn-ts-core/agent.md)

## Steps

1. Hash the password with SHA-1 on your server and send only the first five characters of the hash to the Pwned Passwords range API (no key).
2. Compare the returned hash suffixes with the rest of your hash; a match means the password has been seen in a breach.
3. Reject it with a clear message, and combine the check with a strength meter.

## Watch out

- Send a User-Agent header; Pwned Passwords data is CC BY 4.0, so credit Have I Been Pwned with a link.
- Looking up e-mail addresses (not passwords) is a different API that needs a paid key.

Human page: https://agentgid.com/resources/ideas/block-leaked-passwords/