# Dark web monitoring offering

**URL:** <https://community.passbolt.com/t/dark-web-monitoring-offering/8555>\
**Category:** Feature requests\
**Created:** [September 30, 2023, 4:39pm UTC](https://community.passbolt.com/t/dark-web-monitoring-offering/8555 "2023-09-30T16:39:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mm\_pba](https://avatars.discourse-cdn.com/v4/letter/m/5fc32e/32.png) [@mm\_pba](https://community.passbolt.com/u/mm_pba)\
**Post date:** [September 30, 2023, 4:39pm UTC](https://community.passbolt.com/t/dark-web-monitoring-offering/8555/1 "2023-09-30T16:39:10Z")

</div>

**Q1. What is the problem that you are trying to solve?**  
Notification on compromised credentials.

**Q2 - Who is impacted?**  
All users.

**Q3 - Why is it important and/or urgent?**  
Should be self-explanatory. Notification of potentially compromised passwords is a feature that all major password managers that I am aware of offer.

**Q5. Community support**  
People can vote for this idea to show traction:

_Poll ([view on site](https://community.passbolt.com/t/dark-web-monitoring-offering/8555/1))_

---

<div class="post-metadata">

**Author:** ![Duffman](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/duffman/32/3667_2.png) [@Duffman](https://community.passbolt.com/u/Duffman)\
**Post date:** [October 1, 2023, 6:04pm UTC](https://community.passbolt.com/t/dark-web-monitoring-offering/8555/2 "2023-10-01T18:04:06Z")

</div>

Hi @mm_pba

Thanks for posting your idea. Thanks for using the proper format!

Passbolt already uses the [Have I Been Pwned DB](https://haveibeenpwned.com/API/v3) for all passwords and the new Passbolt password policies allows an administrator complete control.

> [@Data Breach Sources](https://community.passbolt.com/t/data-breach-sources/6455/3):
>
> Hello! Indeed as mentionned by @garrett we are using the API [https://api.pwnedpasswords.com/](https://api.pwnedpasswords.com/), is it the same you are using to check on your side when it comes back clean? Thanks in advance.

What Dark Web Monitoring DB are you suggesting Passbolt add in addition to HaveBeenPwned?

---

<div class="post-metadata">

**Author:** ![Termindiego25](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/termindiego25/32/5517_2.png) [@Termindiego25](https://community.passbolt.com/u/Termindiego25)\
**Post date:** [October 2, 2023, 8:05am UTC](https://community.passbolt.com/t/dark-web-monitoring-offering/8555/3 "2023-10-02T08:05:34Z")

</div>

I think the Have I Been Pwned DB integration for the moment checks the password at the creation time, but not during its life, right?  
If so, there could be a possibility to keep using a compromised password because Passbolt wouldn’t send you a notification advising about the exfiltration.  
I think this is what he is requesting, a way to know if an existing password is compromised or not, rather than the existing one at the creation of a resource