Change a Compromised Password in RoboForm Security Center

Estimated reading: 2 minutes 222 views Contributors

Summary: To detect compromised passwords, RoboForm checks against a list maintained by Have I Been Pwned (HIBP), a service that collects passwords exposed in data breaches.

What is a compromised password?

A compromised password is an individual password that has previously been seen in a documented data breach where hackers released the stolen data publicly or sold it on the Dark Web.

To detect compromised passwords, RoboForm checks against a list maintained by Have I Been Pwned (HIBP), a service that collects passwords exposed in data breaches.

How can I tell which of my passwords have been compromised?

Logins with compromised passwords are marked with a red exclamation point icon in the RoboForm extension and in the Security Center.

What should I do if I see a password that is compromised?

If you see that one of your passwords is compromised, you should update it immediately.

To update a compromised password, follow these steps:

How does RoboForm know that a password is compromised?

RoboForm checks against the Pwned Passwords list maintained by HIBP. The list is comprised of hundreds of millions of real world passwords previously exposed in data breaches. This exposure makes them unsuitable for ongoing use as they’re at much greater risk of being used to take over other accounts.

How does RoboForm securely and anonymously scan my passwords without revealing them?

The passwords on the full HIBP list of compromised passwords are hashed with SHA-1. In addition, the RoboForm client does not transmit complete password hashes when checking against the list.

As discussed in more detail here, we use a technique called k-anonymity in order to verify without revealing the individual password.

Can RoboForm tell me when or where an individual compromised password was hacked?

No, RoboForm’s provider HIBP does not store any information about who the password belonged to, only that it has previously been exposed publicly and how many times it has been seen.