# Ensure leaked-password protection (HaveIBeenPwned check) is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_179010390574233-ensure-leaked-password-protection-haveibeenpwned-check-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure leaked password protection is enabled for the project, so that Supabase Auth checks new and changed passwords against the HaveIBeenPwned Pwned Passwords database and rejects any password that is already known to have been leaked in a data breach.

**Rationale**

Attackers use large lists of leaked passwords to break into accounts through credential stuffing. If users can choose a password that has already been leaked, their accounts are easy targets even when the password looks strong. Blocking known leaked passwords removes one of the most common ways accounts are taken over.

**Impact**

-   Rejects passwords found in known data breaches
    
-   Reduces the risk of credential stuffing attacks
    
-   Users with leaked passwords must choose a new one
    

**Default Value**

By default, leaked password protection is disabled. It is available on the Pro plan and above.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   Pro, Team, or Enterprise plan
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Verify that Prevent use of leaked passwords is enabled (Authentication > Attack Protection also shows this setting).
    
5.  Alternatively, check the Security Advisor for the finding Leaked Password Protection Disabled.
    
6.  If it is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Enable Prevent use of leaked passwords.
    
5.  Select Save.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Authentication in the sidebar, select Sign In / Providers, and open the Email provider.
    
4.  Disable Prevent use of leaked passwords.
    
5.  Select Save.
    

**Reference**

-   [https://supabase.com/docs/guides/auth/password-security](https://supabase.com/docs/guides/auth/password-security)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.