Breached password

Password breaches have become a prevalent threat to online security, and apps, including yours, must take proactive measures to safeguard their users' sensitive information. Ideally, you want all your users to have fresh, unique passwords that haven’t been hacked. This is difficult, but Frontegg makes it easy. This guide will tell you about Frontegg’s breached password detection and how to configure it.

How it works

The breached password engine scans user passwords during the sign-up and login process and compares them to databases of known breached passwords. This is all done without exposing passwords.

If a match is found, appropriate actions can be taken, such as requiring the user to reset their password or implementing additional security measures.

Configuring breached password

All you need to do is choose what should happen when a breached password is detected: Allow, Challenge, or Block.

See the next section to learn more about how user experiences will be affected by each action.

User's experience

Frontegg checks if passwords are breached in two different flows:

• Password use - e.g., during login
• Password creation - e.g., during signup or password changes

You can choose if users can use/create breached passwords or not by selecting one of the actions below:

Analyzing breached passwords in your app

Security events

If you’re curious how often breached password events occur in your app, you can view them over time in Security Events to see when and where they happened.