Breached password protection

Last verified: 2026-06-16.

Passwords that have appeared in a public data breach are the first thing attackers try. Awthy can check a password against the Have I Been Pwned breach database and steer people away from one that is already known to be compromised, so a leaked password is something you catch before it becomes a problem.

Your real password never leaves your site

Awthy uses a privacy-preserving method called k-anonymity. When a password is checked, Awthy creates a one-way fingerprint (a hash) of it and sends only the first five characters of that fingerprint to the breach service. The service returns a batch of possible matches, and your site finishes the comparison locally.

Your actual password is never sent anywhere. The full fingerprint is never sent either. The breach service only ever sees a five-character prefix, which matches thousands of different passwords and cannot be traced back to yours.

Awthy will never ask you for your password or a one-time code in an email or message. If something claiming to be from Awthy asks for your credentials, treat it as phishing.

What happens when a password is breached

The result depends on your role, because an exposed administrator account is far more dangerous than an exposed customer account:

Role	Default behaviour
Administrators and shop managers	Blocked — a known-breached password cannot be used
Customers and all other roles	Warned — the password is allowed, but the user is told it has appeared in a breach

When a password is blocked, the user sees a clear message asking them to choose a different password, and the change is not saved until they do. When a password is only flagged, the user is told the password has been seen in a breach and encouraged to choose a different one, but they can continue if they decide to.

An administrator can relax this per role under Awthy Security → Password protection — for example, downgrading a role from blocked to warned, or turning the check off for a role entirely.

By default, Awthy checks a password when it is set or changed. There is also an optional login-time re-check, which is off by default. When it is enabled, Awthy re-checks an existing password the next time the user signs in, so an account whose password was leaked after it was set still gets caught. If a re-check finds a breached password, the user is prompted to change it according to the same per-role rules above.

You are never locked out by an outage

The breach check depends on an outside service. If that service is unreachable — for example, during a network problem or an outage — Awthy fails open: it allows the password rather than blocking everyone out. You will never be locked out of your own site because the breach service was temporarily down. The check simply resumes the next time the service is reachable.