Password Have I Been Pwned?

This module checks user passwords using Troy Hunt's excellent Have I Been Pwned (HIBP) service.

Specifically it uses the Pwned Passwords V2 (/ v3 - there's not much difference) API which means that only the first 5 characters of the hash of each password checked are sent to the HIBP API (over https).

The module has configurable policies for registration, password change and login. Each policy can block the use of compromised ("pwned") passwords, emit a warning, or do nothing (ignore). By default pwned passwords are blocked at registration or password change, and a warning is emitted at login.

There is also a configurable threshold based on the count for each pwned password returned by the API; higher counts indicate more commonly used (/ breached) passwords.

Thanks to Koen Verheyen for the original implementation.

This module has been developed for Drupal 7. The options for Drupal 10+ sites include:

• https://www.drupal.org/project/pwned_passwords
• https://www.drupal.org/project/password_policy_pwned
• https://www.drupal.org/project/password_policy/issues/2946719