Implementing Password Leak Detection in Spring Boot 3.3 with HaveIBeenPwned

Chrome Browser Password Leak Check

Chrome includes a password leak detection feature that alerts users when their saved passwords have been exposed in data breaches.

Spring Boot 3.3 Password Leak Check

Demo

When a user enters a compromised password, the Spring Security login filter triggers a check and returns a warning.

The provided password is compromised, please change your password

Implementation

@Bean
public CompromisedPasswordChecker compromisedPasswordChecker() {
    return new HaveIBeenPwnedRestApiPasswordChecker();
}

Uses the HaveIBeenPwned API (api.pwnedpasswords.com) to verify passwords.

pwnedpasswords Service

Checks whether a password appears in known breach databases by querying the service with the password hash.