Description
Ensure leaked password protection is enabled for the project, so that Supabase Auth checks new and changed passwords against the HaveIBeenPwned Pwned Passwords database and rejects any password that is already known to have been leaked in a data breach.
Rationale
Attackers use large lists of leaked passwords to break into accounts through credential stuffing. If users can choose a password that has already been leaked, their accounts are easy targets even when the password looks strong. Blocking known leaked passwords removes one of the most common ways accounts are taken over.
Impact
Rejects passwords found in known data breaches
Reduces the risk of credential stuffing attacks
Users with leaked passwords must choose a new one
Default Value
By default, leaked password protection is disabled. It is available on the Pro plan and above.
Pre-Requisites
Project Owner or Admin role
Pro, Team, or Enterprise plan
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Verify that Prevent use of leaked passwords is enabled (Authentication > Attack Protection also shows this setting).
Alternatively, check the Security Advisor for the finding Leaked Password Protection Disabled.
If it is disabled, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Enable Prevent use of leaked passwords.
Select Save.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
Disable Prevent use of leaked passwords.
Select Save.
Reference