The security check reviews your vault and tells you what to fix first. It runs on your device. Only the optional check against known data breaches sends a request out, and that request never contains a password.
What is checked
| Check | Meaning |
|---|---|
| Found in data breaches | The password is in a known collection of leaked passwords. Change it right away. |
| Breached website | The website was breached after you set the password. |
| Account in a data breach | Your email address appears in a breach of exactly this website. |
| Used more than once | You use the same password for several accounts. |
| Easy to guess | The password is too short or too common. |
| Lookalike website address | The saved address imitates another website. |
| Similar passwords | Passwords with the same core, such as "Summer2023!" and "Summer2024!". |
| Unsecured connection (http) | The website does not use encryption. |
| Two-factor sign-in available | The website offers codes or security keys, but the login has none. |
| Passkey available | The website supports passkeys. |
| Expired, Expires soon | Cards and documents with an expiry date. |
| Not changed for a long time | The password is older than a year. For strong, unique passwords that is not a problem. |
| Duplicate items, Without website, Without username | Tidying up helps with filling in. |
From the results Passbox calculates a security score. Each category shows how many points it costs. Fix these first lists the items where a change helps most.
Change a password
Every problem has Change now. Passbox walks you through three steps:
- Open the website and sign in. You can copy the old password here.
- Paste the new password on the website. Passbox has already created a strong one.
- Did it work? Yes, save stores the new password. The old one stays under Previous passwords.
If a hint does not apply to you, dismiss it. Dismissed hints no longer count, but stay visible and can be shown again.
Check for leaked passwords
You start this check yourself. Passbox compares your passwords with the Have I Been Pwned collection without revealing them:
- Passbox computes a hash of each password on your device.
- Only the first five characters of that hash go out. Each such prefix matches hundreds of different passwords.
- The answer contains all matching hashes. Passbox checks on your device whether yours is among them.
By default the request goes through your Passbox server. Have I Been Pwned then sees the server's IP address, not yours. In the security check's settings you can choose the direct connection instead.
Breached websites
Passbox downloads the public list of known data breaches and compares it with your logins on your device. Everyone gets the same list, so the server does not learn which websites you use.
When a new breach affects one of your logins, Passbox tells you: in the web app with a banner and, if you allow it, a browser notification; in the desktop app, the extension and the phone apps with a notification.
Email breach monitoring
If your server offers it, Passbox monitors your email addresses and writes to you as soon as one appears in a new breach. You confirm each address with a code sent to it, so nobody can monitor someone else's address.
Your plan
Above the results, Your plan orders the work into up to five steps, with a priority and the first websites affected. For two-factor sign-in, important accounts such as email, banking and government come first.
If you turned on the AI features, a model of your choice can explain the steps. It only gets the kinds of problems, their number and the domains, never passwords.
In Business organizations
In a Business organization, members' apps send numbers to the server once a day: the security score and how many logins are weak, reused or unsecured. They count the logins the member can see, including those in their personal vaults. Admins see only these numbers in the reports of the admin console. Passwords and items never leave the device for this.