Breached password detection for your users
Breached password detection checks a password against the passwords already exposed in public data breaches, so that a user cannot keep one an attacker already holds. The Skycloak Platform plans this check into its sign-in engine, so your product gets it without your team writing or hosting it.
Why a breached password is a weak password
Many people use the same password on several websites. When one of those websites is breached, its passwords end up in lists that attackers try against every other site, and a password that appears in such a list protects very little however long or complex it looks.
Complexity rules cannot catch this, because a long phrase with symbols in it can still be one that leaked years ago. The reliable test is to compare the password with the passwords that are known to be exposed.
How the Platform checks passwords
The Platform's plan checks passwords against Have I Been Pwned, the public collection of passwords from known breaches, when a user sets a password and when they sign in with it. Your application does not change: the check runs in the sign-in engine, on the hosted sign-in pages your users already see.
When the outside service cannot be reached, the engine checks a local copy of the list and lets the user sign in. A problem at a third party never locks your users out of your product.
Going further than passwords
A breached password check lowers the risk that comes with passwords, and the strongest step is to need no password at all. Passkeys and multi-factor authentication are on the Platform's plan, and users who move from Keycloak keep the passkeys and second factors they already have.
We describe a Platform feature as available only once it has shipped, so a demo is the place to see what you can use today.
Frequently asked questions
Is breached password detection the same as a password strength rule?
No. A strength rule looks at the shape of a password, such as its length and the kinds of characters in it. Breached password detection looks at whether that exact password has already leaked, which a strength rule has no way of knowing.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.