Behavior of Auth0 Breached Password Detection

This article details the behavior and error messages that occur across different Auth0 interfaces when administrators successfully configure Breached Password Detection. It covers user creation and password changes via the Dashboard, Management API, and Universal Login.

• Auth0
• Breached Password Detection
• Universal Login
• Management API

What are the outcomes when Breached Password Detection is active?

Once administrators successfully configure Breached Password Detection, specific outcomes and error messages occur across different Auth0 interfaces when a user enters a breached password.

• Dashboard User Creation: When creating a user from the Dashboard with a breached password, the action fails, and the following error message displays:

   

  Error! PasswordBreachedError: Password is part of a known breached credentials dataset

   

  

• Management API User Creation: When creating a user from the Management API with a breached password, the API returns the following error:

  {
    "statusCode": 400,
    "error": "Bad Request",
    "message": "PasswordBreachedError: Password is part of a known breached credential dataset"
  }

   

• Universal Login Sign-up: When a user attempts to sign up from the Universal Login with a breached password, Auth0 prevents account creation and displays the following warning:

This combination of credentials was detected in a public data breach on another website. Before your account is created, please use a different password to keep it secure

• User Password Change: When a user attempts to change their password to a known breached password, the same error as user creation displays.

• Tenant Admin Password Change: When the Tenant Admin attempts to change a password to a known breached password, the following error displays:

Error! PasswordBreachedError: Password is part of a known breached credentials dataset

NOTE: Auth0 uses a hashed password value for the comparison, not plaintext.