# Pwned Passwords Validator

**URL:** <https://meta.discourse.org/t/pwned-passwords-validator/90074>\
**Category:** Plugin\
**Created:** [June 17, 2018, 11:10pm UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074 "2018-06-17T23:10:34Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![featheredtoast](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/featheredtoast/32/116994_2.png) [@featheredtoast](https://meta.discourse.org/u/featheredtoast)\
**Post date:** [June 18, 2018, 3:49pm UTC](https://meta.discourse.org/t/pwned-passwords-validator/90074/15 "2018-06-18T15:49:54Z")

</div>

I’ve added the threshold. It defaults to banning the password if it appears at all, which takes care of both concerns.

> [@jtbayly](#):
>
> The number of times a password has been hacked is irrelevant

Troy seems to have added the count in v2 as feedback:

> Now on the one hand, you could argue that once a password has appeared breached even just once, it’s unfit for future use. It’ll go into password dictionaries, be tested against the username it was next to and forever more be a weak choice regardless of where it appears in the future. However, I got a lot of feedback from V1 along the lines of “simply blocking 320M passwords is a usability nightmare”. Blocking half a billion, even more so.

It still defaults to the functionality you describe, but admins can now tune to their liking.

> [@tophee](#):
>
> this is cryptic

Updated to read “has appeared previously in a data breach. Please use a more secure password.” which should address this.

---

_[View the full topic](https://meta.discourse.org/t/pwned-passwords-validator/90074)._