KeysWalletWatch · How-to guides
How to use the Security dashboard and check passwords against breaches
The Security dashboard scores the vault and lists old, reused and weak passwords. Check All Passwords compares them with Have I Been Pwned without sending any password.
Short answer: Click the shield icon at the bottom of the sidebar to open the Security Dashboard. It shows a Health Score and lists old, reused and weak passwords. Click Check All Passwords to compare every password with known breaches (Have I Been Pwned); only the first five characters of each password's hash leave your PC.
Steps
-
Open the dashboard
Click the shield icon at the bottom of the sidebar. When a breach check is due it shows with a warning mark and the hint "Time for a password check-up".
-
Read the score and the tiles
The Health Score sits on top, with tiles for Old Passwords, Reused Passwords, Weak Passwords and the date of the last Breach Check. In Developer Mode there is also Expiring Secrets.
-
Open each list
Click Aging Passwords, Reused Passwords or Weak Passwords to expand it. Reused passwords are grouped ("Group (3 entries)"); weak ones show a score out of 4 and an estimated time to crack.
-
Run a breach check
Under Breach Check click Check All Passwords. A counter shows progress. At the end you see either "No breached passwords found." or how many were found, with the number of exposures for each entry.
-
Fix what it found
Change the password on the website first, then open the entry, click Generate for a new strong password (length is set in Settings → General → Default Password Length) and save. Start with breached, then reused, then weak.
-
Tune the rules
Settings → Security → Security Policies: Credential Age Warnings (flag passwords older than 30 days to 1 year), Duplicate Password Detection (2+, 3+ or 5+ entries) and Breach Check Reminders (every 1 to 12 months).
Worth knowing
- The breach check uses the Have I Been Pwned range API with k-anonymity: your PC sends the first 5 characters of a password's SHA-1 hash and compares the returned list locally. The password itself never leaves the PC.
- Every entry keeps a password history, so a password you change is not lost if you need the old one.
Questions
- Does the breach check send my passwords anywhere?
- No. Only the first 5 characters of each password's SHA-1 hash are sent to Have I Been Pwned; the match happens on your PC.
- What counts as a reused password?
- The same password on 2 or more entries by default. Change the threshold in Settings → Security → Duplicate Password Detection.