How does wordfence know if I’m using a password that has been breached?

These come from public lists of breached passwords from other orgs. Very common tool for hackers to gain access to other sites.

https://www.wordfence.com/blog/2018/03/password-leak-attacks-wordpress/

Hi @countercharge,

Indeed, as outlined in the blog post mentioned by @jebus, the details of compromised accounts also include hashed versions of passwords.

You can also find more information regarding the “Prevent the use of passwords leaked in data breaches” feature in our documentation.

******************************

@jebus,

Thanks for helping out!