Common password

Configure the browser-side Pwned Passwords check and understand its network and failure behavior.

Common password

The breach rule checks the new password in the browser against the Have I Been Pwned Pwned Passwords range API. The browser computes SHA-1 locally, sends the first five hexadecimal characters of the hash, and compares returned suffixes locally. It does not send the plaintext password or the complete hash to that service.

{
  "type": "breach",
  "description": "password_reset.rules.breach"
}

The browser needs outbound HTTPS access to api.pwnedpasswords.com. This is an external browser-side dependency, not a server-side enforcement guarantee. In the current UI, a failed request is caught and does not mark the password as breached; a subsequent validation retries rather than reusing the failed check. Enforce any mandatory breach policy separately in the reset integration.

See Pwned Passwords for service information.