Free & open · no paywall, ever

IntegrAuth Academy

Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.

Choose your program Browse the 20 tracks
20 tracks 241 lessons 242 hands-on labs 230+ diagrams 100% free

English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.

How?
  • Chrome on phone: ⋮ menu → Translate
  • Chrome on computer: right-click → Translate to …
  • Edge: the translate icon in the address bar
Identity & API Security Track 2 · Modern Authentication
0/166 lessons read
AUTHENTICATION · LESSON 7

Breached-password detection

Billions of passwords sit in public leak lists. If Maya picks one, her account is easy to break. So check, and block, before harm is done. You can check without ever sending the password. Your goal: explain how the check works and what to do on a match.

Key points
  • Send only the first 5 characters of the password's hash.
  • The service returns a list. Your server finds its own match.
  • On a match, block the sign-in and start a reset.
  • "Not breached" does not mean "strong".

The k-anonymity trick

How can you ask "is this password in a leak list?" without sending the password? Use k-anonymity. You ask for a whole range of answers and find your own match.

  1. Your backend makes a hash of the password with SHA-1. A hash is a one-way fingerprint.
  2. It sends only the first 5 characters of that hash to the breach service.
  3. The service returns the rest (the suffix) of every hash that starts with those 5 characters. That is hundreds of them.
  4. Your backend looks for its own suffix in that list.

The password, and even its full hash, never leave your server.

AppBackendBreach range API1 · POST /check {password}2 · SHA-1(password) → take 5-char prefix3 · GET /range/{prefix} — only 5 hex leavelist of hash suffixes + counts4 · match suffix locally → breached? countverdict: { breached, count }5 · if breached → request reset6 · password-change ticket ✓
Figure — The password never leaves. Five hash characters fetch a list of candidates. The match happens at home.
Think of it like…

Asking a librarian for "every book whose title starts with Th", then finding yours in the pile. The librarian never learns which book is yours.

Maya's story

A shopping site that Maya used was hacked last year. Thieves put its passwords on the internet. Today Maya picks the same password for a new app. The leak check sees it at once. The app blocks it and asks for a new one. The thieves never get the chance.

Block, do not warn

A warning that the user can ignore is not a control. When a password matches, block the sign-in and start a guided reset. Tell the user and the admins.

Leak lists come in two kinds. A standard list updates now and then, so new leaks have a gap. A continuous feed catches new leaks within hours.

Watch out

"Not breached" does not mean "strong". A leak check removes only the worst passwords. Length rules still matter. Any password can leak later. The strongest answer is to have no shared secret to leak. That is what a passkey gives you. See passkeys.

Go deeper: NIST password rules

SHA-1 is fine here because it is only a lookup key. Never use it to store passwords.

NIST SP 800-63B-4 adds four rules. Require at least 15 characters for a password used alone. Check against leaked and common lists. Do not force changes on a schedule. Do not demand special characters.

Password managers use the same range query.

🧪 Interactive lab — enable JavaScript to play with this one.

🧪 Try it free

Adding leak checks at sign-up and login? Talk to our team.