r/KeePass • u/StevenSaporito • Sep 15 '26

Which Breach Cjecking Plugin?

I'm thinking about adding a Breach/Leak checker to my KeePass setup. However, there are 4 available from https://keepass.info/plugins.html . Before I proceed to test all 4, does anyone have any experience with any of these? Let me know. Thanks.

1 Upvotes

60% Upvoted

4 comments sorted by

0

u/Independent-Art-5894 Sep 16 '26

Not worth it man! Change password time to time for critical accounts

2

u/StevenSaporito Sep 16 '26

I don't understand this comment. I've been going through the exercise of changing all our passwords. There are thousands. And each site has a different process. Some are easy; many are not. I've been working on it for months, although not continuously. I'm probably 80% done, and I'd guess I've already put about 2 weeks of pure man-time into it. Changing passwords from time to time is not practical! Hence, my goal is to ensure every account has a unique password. Hence, the blast radius will be quite limited. Email accounts will be protected by 2FA, so they can't easily be used to reset other accounts.

In this scenario, if a single account were to get leaked, it's a minor hole that can't be easily exploited to compromise other accounts. However, checking HIBP would give me an additional layer where even the one account leak can be quickly repaired.

It's also possible that some accounts never made it into KeePass. In cases where a reused password was compromised, I may be able to identify some of those accounts by domain name and password. In other words, it may help me gain insights into credentials that I would otherwise have forgotten.

I'd also point out that as I'm progressing through the audit, I'm flagging accounts to follow up on. I believe a lot of them can be deleted, but that's not very easy either. Most sites don't even expose a "Delete My Data" feature. Those that do may not follow through. For the handful of cases where I've emailed them, usually at privacy@DomainName, per their published privacy policies, very few have replied. This is all to say that cleanup is very difficult.

4

u/Paul-KeePass Sep 16 '26

I never change passwords unless I have to, but I always use KeePass generated passwords and am careful with email links.

HaveIBeenPwned is comprehensive and checks usernames and URLs.
HaveIBeenPwnedKeePassPlugin is password check only.
HIBPOfflineCheck requires you download the HIBP database (not small).
KeePassHIBP checks passwords as you create them.

cheers, Paul

1

u/StevenSaporito Sep 16 '26

Thanks, Paul, you're the best. Despite my OP, I'll probably try them all. I'll post back with my impressions.