Password Safety
TurboPanel checks every password you set against the Have I Been Pwned (HIBP) database of known data-breach credentials. If a match is found, the password is rejected with a clear message.
Your password is never shared
TurboPanel uses k-anonymity: only the first 5 characters of the SHA-1 hash of your password are sent to HIBP. The full password never leaves your device or server. HIBP returns a list of hash suffixes that match that prefix; comparison with your full hash is done locally, so your password is never transmitted.
How it works
- Your password is hashed with SHA-1 (used only for the HIBP API; account storage uses a separate secure hash).
- The first 5 characters of the hex hash are sent to the HIBP API.
- HIBP returns all known hash suffixes that share that prefix.
- The server compares the remainder of your hash against the list locally.
- If any match is found (count > 0), the password is rejected as compromised.
When you'll see this
You will see the compromised-password message in these flows:
- Sign up — when creating a new account
- Reset password — when setting a new password after requesting a reset
- Change password — when changing your password in account settings
API behaviour
When a compromised password is submitted, the API returns HTTP 400 with the message: "That password isn't safe to use. Please choose a different one."
Relevant endpoints:
POST /api/auth/sign-up/emailPOST /api/auth/reset-passwordPOST /api/auth/change-password
Related
- API Reference — Interactive REST API documentation
- Security — Control plane and daemon security best practices
Last updated on