---
id: 4379
title: "Passbolt: a bold use of HaveIBeenPwned"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html"
published_at: "2024-04-16T22:00:00Z"
tags: ["privacy", "password-cracking", "k-anonymity", "password-manager", "passbolt", "haveibeenpwned"]
phying_url: "https://phying.com/item/4379"
lang: en
---

# Passbolt: a bold use of HaveIBeenPwned

## Summary

Quarkslab shows Passbolt's use of the Pwned Passwords API leaked the passwords it checked: an observer of API queries could recover an 11+ character password via incremental search; fixed in v4.6.2.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2024-04-16T22:00:00Z
- **Original:** https://blog.quarkslab.com/passbolt-a-bold-use-of-haveibeenpwned.html
- **Phying News:** https://phying.com/item/4379