A new service makes it easier to know if old passwords you’ve used have been made public in a data breach.
The Pwned Passwords tool, integrated into the popular password manager 1Password, lets customers type in an old password and find out if it’s been leaked in a data breach.
Security researcher Troy Hunt announced the tool, which lists more than 500 million leaked passwords, last week. Users can access it online. Developers can also use an API to incorporate the function in their own tools.
AgileBits is the first company to announce it’s integrated the tool into its password manager, 1Password. In a blog post Thursday, the company explained how the service works. It doesn’t transmit the entire password to the service to be looked up. Instead it produces a cryptographic hash function known as SHA-1, which uses the first five characters of the password to look for a match. This is more secure than sending the entire password, the company said. For a more detailed look at how it works, AgileBits recommends reading Hunt’s detailed description in his blog post.
AgileBits also said a positive hit in the database doesn’t necessarily mean your account has been compromised.
“Someone else could have been using the same password,” the company said. “Either way, we recommend you change your password.”
The tool comes as companies like Yahoo and Equifax, a credit monitoring agency, within the past year have reported massive security breaches that affected billions of people. In October, Yahoo announced the largest hack ever, saying all 3 billion of its customers’ accounts had been breached in 2013. Equifax said in September that hackers stole information — including Social Security numbers, credit card numbers, names and addresses — on up to 143 million Americans.
Keep in mind that the Pwned Passwords tool should only be used to search for old passwords. You shouldn’t be checking whether a current password has been hacked, since it’s never a good idea to share an existing password with a third party.
For more information on solutions for running your businesses’ technology more efficiently, visit our website or contact Megan Meisner at mmeisner@launchpadonline.com or 813 448-7100 x210.
This was originally posted by CNet.com
