new·Earn with mozg — 20% of every monthSend somebody here and take a fifth of every plan payment they make, for as long as they keep paying — not a bounty on the first invoice. Your handle is the link, the window is thirty days, and the commission lands on your balance the second they pay. Free to join: if you have signed in, you already have the link. mozg.sh/earnall news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

have i been pwned plugin

10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Have I Been Pwned plugin installation

Import haveIBeenPwned from 'better-auth/plugins' and add it to the plugins array in the betterAuth config. The plugin can be instantiated with haveIBeenPwned().

Have I Been Pwned default error response

When a user attempts to create an account or update their password with a compromised password, the error response is: code 'PASSWORD_COMPROMISED' with message 'The password you entered has been compromised. Please choose a different password.'

isPasswordCompromised function for custom flows

The isPasswordCompromised function can be imported from 'better-auth/plugins/haveibeenpwned' to check passwords in server-side flows that do not use Better Auth endpoints. It returns a boolean indicating if the password is compromised and throws an APIError if the service cannot complete the check.

Have I Been Pwned enabled configuration option

The 'enabled' option enables or disables password checks against the HIBP database. It defaults to true and is useful for skipping checks in development or testing without removing the plugin.

Have I Been Pwned customPasswordCompromisedMessage option

The 'customPasswordCompromisedMessage' option allows customization of the error message shown when a compromised password is detected.

Have I Been Pwned hash privacy

Only the first 5 characters of the password's SHA-1 hash are sent to the Have I Been Pwned API. The full password is never transmitted.

isPasswordCompromised example usage

import { isPasswordCompromised } from "better-auth/plugins/haveibeenpwned" const compromised = await isPasswordCompromised(password) if (compromised) { throw new Error("Please choose a password that has not been compromised") }

Have I Been Pwned plugin installation example

import { betterAuth } from "better-auth" import { haveIBeenPwned } from "better-auth/plugins" export const auth = betterAuth({ plugins: [ haveIBeenPwned() ] })

Have I Been Pwned enabled option example

import { betterAuth } from "better-auth" import { haveIBeenPwned } from "better-auth/plugins" const auth = betterAuth({ plugins: [ haveIBeenPwned({ enabled: process.env.NODE_ENV === 'production' }) ] })

Have I Been Pwned customPasswordCompromisedMessage example

import { betterAuth } from "better-auth" import { haveIBeenPwned } from "better-auth/plugins" const auth = betterAuth({ plugins: [ haveIBeenPwned({ customPasswordCompromisedMessage: "Please choose a more secure password." }) ] })

Give your agent this brain