Validating Leaked Passwords with k-Anonymity

What this post added

This post details Cloudflare's technical contribution to the 'Have I Been Pwned' service by developing an API that uses k-anonymity and range queries to validate leaked passwords. This approach allows clients to check if a password has been breached without sending the complete unsalted password hash to the service, thereby enhancing user privacy and security. It also highlights the broader context of password security issues like credential stuffing and the limitations of traditional password composition rules.