Nextcloud will check passwords against database of HaveIBeenPwned

Users tend to use the same passwords in multiple locations, which poses a significant risk in case passwords are stolen. Last Thursday, Security researcher Troy Hunt, known from his site HaveIBeenPwned, expanded his existing dataset of 306 million leaked passwords with another 200 million, bringing the total to half a billion. Organizations can use this list to check passwords against, ensuring their users don’t pick a password that is known and thus likely to be tried by hackers when trying to break into a system.

Pwned Passwords

His collection of passwords, named Pwned Passwords, uses SHA1 hashes of the passwords to allow checks against it. It also offers a counter to show how often a password is used in the database, with abc123 having a count of 2.5 million according to a blog by Hunt.

In this blog, Hunt also explains he gathered the 8,8GB worth of passwords from a series of public leaks and he warns strongly against using passwords part of his collection. He made them available to be collectively downloaded via a torrent and on his website he offers an API which can be used to check passwords against. It is a common practice of both attackers and defenders in computing security to built lists of commonly passwords which are in turn used in so called Rainbow Tables which are used to recover username/password combinations from encrypted, stolen databases. Or, like in this case, to ensure users don’t use previously breached passwords.

The online test of Pwned Passwords

Current Password Policy settings in Nextcloud

Password security in Nextcloud

Currently, Nextcloud allows administrators to enforce a NIST compliant password quality, which includes a check for commonly used passwords like ‘test’ and ‘abcabc. The limitations are checked when a user chooses a new password, or when the admin creates a new user with password. The new test against the HaveIBeenPwned database queries its database through their public API, giving a warning if the password has been breached.

As shipping a 8.8 gb password database alongside Nextcloud would probably make the download a little to big for most users. By sending a partial hash (the first five characters), we avoid any increased risk of leaking the password as, even if intercepted, those first 5 characters of a long hash aren’t very to helpful crack the full password. Besides, the attacker wouldn’t know the user name. The administrator can enable or disable this feature – we still have to determine if we’ll enable it by default but likely not.

This improvement helps make passwords more secure, avoiding the use of known breached passwords and adding to our brute-force protection, two-factor authentication and existing password quality checks to ensure strong account protection.

The new check will be part of Nextcloud 14 and might also be backported to Nextcloud 13 in one of the upcoming patch releases. While this technically qualifies as a new feature (and backporting features always comes at a risk), password security is very central to keeping data under control and thus worthy of some extra testing effort. We still recommend to use the built in two-factor authentication to provide additional protection against stolen passwords!

Update: the code has been reviewed and merged and will be backported to 13.0.1. It will be disabled by default.

Notable Replies

  1. dsb says:

    Please do not turn that on by default. Just my 2¢. Not everyone will be comfortable using that service, and having it on by default means that the initial login would use the service. I suppose if there were a popup on initial login asking about that, but you already ask about sending metrics, so it’s probably not a good design idea to have that pop up then.

  2. @dsb
    ummm… you already saw that it’s admin’s choice turning it on or not?

  3. m4lvin says:

    I like this feature, but also think it should be opt-in. And maybe someone could clarify the following points?

    1. When exactly is the check done? When the passwords are set or on every log-in?
    2. What happens when the API is unreachable? Will Nextcloud fall back to allowing all passwords or stop working?
    3. Worst-case scenario: If Troy turns evil :smiling_imp: and makes the API always return a match, would this effectively forbid all passwords? Or is this impossible because to match all hashes, the reply would have to be much larger?
    4. In the blog post “hash of the first 5 characters” sounds like you are truncating the password and then hashing, but as far as I understand, you first hash and then send the first five characters of the hash to the API
    5. The sentence “In this blog, Hunt also explains …” misses some word, or where can I download Troy himself? :wink:
  4. You can download Troy here.


    In all seriousness, I updated the article to answer your questions, thanks for asking.

    1. when you choose a password, our current password check enforces the rules the admin has set. So that will be the same with this new, optional, additional check.
    2. When it can’t check - good question. I suppose it’ll give some kind of error, but if that means approval or denying - I would expect the latter would be the best choice. As user, you’d then have to contact support/the admin to get the problem fixed. Better than allowing a bad password to be chosen! @rullzer will know.
    3. Yes, I suppose it would. So as admin you’d get contacted as nobody can create new passwords and you’d have to disable this check.
    4. Fixed, you’re right.
    5. fixed :wink:
  5. To complete the reply from @jospoortvliet

    1. Yes when you set the password.
    2. Currently it fails and the tests passes. I did this because you still want to be able to test passwords when the API is not reachable. But please open an issue at to discuss this.
    3. He could. But I guess word of that would spread quickly. Also since we send only the first 5 characters of the hash of the password he would have to return every hex combination of the remaining 35 characters. So 16^35 lines. That would timeout. And also make his traffic bill huge I’d think :wink:
    4. Yes, first we hash the password. Then we take the first 5 characters of the hash. We then ask from the API all the hash that start with those 5 chars and check for a match with the remaining 35 characters.

    I hope this explains it all.

  6. You won’t send anything during the intial logon. Password policy is checked when setting a password. Not when using it.

Continue the discussion The Nextcloud forums