Password Health and the Breach Scan

The security score

The score in the header is out of 100 for the whole vault. Next to it is the number of credentials that need attention. Click it to open the Needs attention view.

What is checked

• Weak. The password is short or easy to guess.
• Reused. The same password is on another credential in the vault. The credential shows how many others share it.
• Breached. The password appears in a known data breach.
• Expiring soon. The expiry date is within 30 days.
• Expired. The expiry date has passed.
• Rotation overdue. The password is older than the Rotate every setting on the credential. If no schedule is set, a password older than a year is flagged.
• No 2FA. A login has a password and no 2FA code stored.

Fix a problem

Open the credential, click Edit, and use the generator to set a new password. Change it on the service itself as well. The vault only stores the password; it does not change it for you.

The breach scan

Administrators can run a scan from More → Run a breach scan. It checks every password against a public list of passwords found in data breaches.

Your passwords are not sent anywhere. For each one, the vault makes a scrambled fingerprint and sends only its first five characters. The service returns every fingerprint that starts with those characters, and the vault checks for a match itself.

Results appear as Breached badges and in the In a data breach view.

Set an expiry or a schedule

Edit a credential and set:

• Expires on for something with a fixed end date, such as a licence or certificate.
• Rotate every for a password that should be changed on a schedule.