# Data Breach Sources **URL:** \ **Category:** Community Feedback\ **Created:** [February 1, 2023, 11:46am UTC](https://community.passbolt.com/t/data-breach-sources/6455 "2023-02-01T11:46:19Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![abcyb](https://avatars.discourse-cdn.com/v4/letter/a/b2d939/32.png) [@abcyb](https://community.passbolt.com/u/abcyb)\ **Post date:** [February 1, 2023, 11:46am UTC](https://community.passbolt.com/t/data-breach-sources/6455/1 "2023-02-01T11:46:19Z")
Hey, how does the “This password is part of an exposed data breach” functionality work? I read about an API Call from the client extension to [https://haveibeenpwned.com](https://haveibeenpwned.com), however, when i check the flagged password against the website, it comes back clean. Are there other sources? regards ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 1, 2023, 12:46pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/2 "2023-02-01T12:46:20Z")
Hi @abcyb Welcome to the forum! Which browser are you using? Browsers also have these warnings - possibly it is from the browser and not the extension? It’s a little hard to find in the code because it’s named `powned` but here is a link to the trusted function which calls the api [passbolt\_browser\_extension/pownedService.js at 22a0bb9992303676a17d4c3c6bb1929d27d76ce1 · passbolt/passbolt\_browser\_extension · GitHub](https://github.com/passbolt/passbolt_browser_extension/blob/22a0bb9992303676a17d4c3c6bb1929d27d76ce1/src/all/background_page/service/secret/pownedService.js#L19) A simple call is being made with the string of the password which was entered. ---
**Author:** ![antony](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/antony/32/3130_2.png) [@antony](https://community.passbolt.com/u/antony)\ **Post date:** [February 1, 2023, 1:03pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/3 "2023-02-01T13:03:08Z")
Hello! Indeed as mentionned by @garrett we are using the API [https://api.pwnedpasswords.com/](https://api.pwnedpasswords.com/), is it the same you are using to check on your side when it comes back clean? Thanks in advance. ---
**Author:** ![abcyb](https://avatars.discourse-cdn.com/v4/letter/a/b2d939/32.png) [@abcyb](https://community.passbolt.com/u/abcyb)\ **Post date:** [February 1, 2023, 1:13pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/4 "2023-02-01T13:13:19Z")
I am using Chrome, but i am not using the integrated Google Password Manager (which has this functionality afaik). I deactivated all extensions in chrome except passbolt and can still see the warning. @antony I checked with [Have I Been Pwned: Pwned Passwords](https://haveibeenpwned.com/Passwords) The password that is flagged in passbolt comes back clean on the website. ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [February 1, 2023, 1:27pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/5 "2023-02-01T13:27:15Z")
@abcyb is the password length short? Passbolt may assume it’s part of a breach if it’s short, even though it is not listed as breached by pwnedpasswords. ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 1, 2023, 1:30pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/6 "2023-02-01T13:30:23Z")
> [@abcyb](#): > > am using Chrome, but i am not Here’s what it looks like on a fresh Chrome install if it’s coming from Chrome: ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/d/d45776e1b01e5714fe24a6b2d8864a8c0166c737.png) ---
**Author:** ![abcyb](https://avatars.discourse-cdn.com/v4/letter/a/b2d939/32.png) [@abcyb](https://community.passbolt.com/u/abcyb)\ **Post date:** [February 1, 2023, 1:41pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/7 "2023-02-01T13:41:40Z")
@remy It looks like this could be the case, i just tested with some random passwords. We usually do 25+ Characters so i never enocuntered this issue before 🙂 ghdlakd → “Data Breach” Very weak (entropy: 32.9 bits) ghdlakd1 → “safe” Very weak (entropy: 41.4 bits) same for whatever randomize character i use instead of the “1”. So, everything above 8 characters seems to be “okay”, everything below is a “data breach”. I really appreaciate this feature, but it should just say “your password is sh$t” instead of telling me that it is part of a data breach, cause that is a bit of another level of “sh$t” 🙂 Well, our customer has to change their passwords anyway, so not much loss. But it does lead to false assumptions. ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 1, 2023, 1:58pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/8 "2023-02-01T13:58:29Z")
This is good feedback thank you @abcyb ---
**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\ **Post date:** [February 1, 2023, 2:03pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/9 "2023-02-01T14:03:53Z")
If I remember correctly it was designed like this to avoid hammering the pwnd API. We could change the message, like “your password is part of dictionary” instead. ---
**Author:** ![garrett](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/garrett/32/545_2.png) [@garrett](https://community.passbolt.com/u/garrett)\ **Post date:** [February 1, 2023, 2:24pm UTC](https://community.passbolt.com/t/data-breach-sources/6455/10 "2023-02-01T14:24:40Z")
> [@remy](#): > > “your password is part of dictionary” Though that may not be the case. Maybe: “too short for testing against data breaches”