Helping keep customers safe with leaked password notification

This post introduces a new feature that automatically checks Cloudflare user passwords against threat intelligence sources monitoring data breaches. If a leaked password is detected during login, the user is alerted and prompted to reset their password after a grace period of three login attempts. The post also details how credentials leak (hashing, salting, credential stuffing attacks) and how customers can protect themselves (unique passwords, password managers, two-factor authentication). It explains the technical implementation of the leaked password check using password hashes and fast lookups, and outlines future plans for increasing 2FA adoption and expanding SSO capabilities.