Overview
Nudge Security gives you the ability to flag passwords that have appeared in known data breaches and nudge employees to change breached passwords.
When an employee signs in to an app with a password, the Nudge browser extension checks that password against Have I Been Pwned's breached password database using a privacy preserving method. If it finds a match, Nudge can immediately nudge the employee in the browser to change it. Nudge can also create a security posture finding so your team can follow up.
Attackers use breached passwords in credential-stuffing attacks, even when the password is long or complex. NIST SP 800-63B recommends rejecting passwords found in breach corpuses for this reason.
How the check works and how passwords stay private
It’s important to know that the password itself never leaves the employee's browser, and Have I Been Pwned never receives its full fingerprint. Here’s how it works:
The employee completes a password login to an app in the browser.
The extension converts the password into a fingerprint (a hash) on the employee's device.
The extension sends only a small portion of that fingerprint to Have I Been Pwned.
Have I Been Pwned returns the list of breached-password fingerprints that share that portion.
The extension compares the full fingerprint against that list locally, on the device.
If there's a match, the extension reports that the account uses a breached password. It does not report the password itself.
Have I Been Pwned is a third-party service. Because it only ever sees a partial fingerprint, it can't determine which password was checked or whether it matched.
What you see in Nudge Security
Breached password status appears on the account and on the user, and each detection creates a finding.
Account details: shows when the account's password has been found in a breach.
User details: shows which of the user's accounts use a breached password.
Findings: severity depends on whether the app is marked business-critical.
Finding | Severity |
Breached password detected for an account in a business-critical app | Critical |
Breached password detected for an account | High |
Each finding names the user and app and recommends this remediation: contact the user to change the password immediately, make sure the new password is unique and not reused in any other app, enable MFA where available, and review recent account activity for signs of unauthorized access.
Nudging employees and resolving findings
Nudge can prompt the employee in two ways:
Browser nudge: when enabled, the extension shows a breached password nudge right after the login, asking the employee to change the password now to a new, unique one, change it anywhere else they've reused it, and consider a password manager.
Ad hoc nudge: from the account, an admin can send the employee a nudge after the fact. Use this when the employee dismissed the browser nudge but hasn't changed the password.
The finding resolves on its own. Once the extension sees the employee sign in with a new password, Nudge updates the account status and resolves the finding. This works the same way as weak password detection.
Turning it on
Breached password detection and nudging settings are off by default until an admin enables them. There are two separate browser extension settings:
Breached password detection: checks the passwords your employees use against passwords exposed in known data breaches.
Breached password nudge: shows employees the browser nudge when a breached password is detected.