Password health
Last updated October 23, 2026
Password health looks through the logins in your open Castle and tells you which ones need attention. The analysis runs on your device. Your passwords are not sent anywhere for it. One extra check, against known data leaks, is optional and off until you turn it on.
Where to find it
- Browser extension Open the full view or the side panel, then choose Tools → Password health.
- Phone app Open Settings → Password health.
You see a count for each check and a Needs attention list with a line of advice for each login. Password health covers the Castle that is open. To look at another Castle, open it and check again.
The five checks
- Found in a breach. The password appears in a public list of leaked passwords. This check only runs if you turn on the breach check below. Advice: “This password appears in known data leaks. Change it now.”
- Weak password. MoatKey’s strength estimate, the same one used for master passwords, says it is easy to guess. Advice: “Easy to guess. Use the generator for a long random one.”
- Reused password. Two or more logins have exactly the same password. MoatKey compares them on your device with a one-time random key that is held only in memory and then discarded. Advice: “Used on more than one login. Give each its own.”
- Old password. The login has not been edited for 12 months. See below. Advice: “Not changed in a year or more. Consider a fresh one.”
- Two-step available. The site is on a short built-in list of sites that offer two-step sign-in, and MoatKey holds no authenticator for it, either on the login or as a separate Authenticator item. Advice: “This site offers two-step sign-in. Add an authenticator.” See Authenticator codes.
What “Old” really means
MoatKey does not know when you last changed the password at the website. It uses the time the saved login was last edited in MoatKey. If you change the password at the site and do not update the login here, the login keeps looking old. Any edit to the login starts the 12 months again.
What is left out
Logins in the Dungeon are left out of every check, and the screen tells you how many were skipped (for example “3 logins in the Dungeon are left out.”). See The Dungeon.
The breach check (optional)
The breach check asks a public service whether a password has appeared in leaked data. It is off until you turn it on. To turn it on, tick Check my passwords against known breaches on the Password health screen.
What is sent
To check, MoatKey sends only the first 5 characters of a fingerprint of each password to the Pwned Passwords service, never the password itself. The rest of the match happens on your device.
- Your device makes a one-way fingerprint (SHA-1) of the password.
- It sends only the first 5 characters of that fingerprint to
api.pwnedpasswords.com. The service answers with every leaked fingerprint that starts with those 5 characters, padded with extra entries so the size of the reply does not hint at your password. - Your device looks for the rest of the fingerprint in that list. Nothing about the match is sent back.
- The request carries no cookies and no referrer, and no MoatKey account or key.
What the service and the network can see
The Pwned Passwords service, and anyone watching your network connection, can see the 5 characters and your device’s IP address. They do not see your password, the full fingerprint, your usernames, website addresses, item names or your MoatKey account. MoatKey’s own servers are not involved and learn nothing about the check.
What stays on your device
Whether a password was found, and how many times, is kept only while MoatKey is unlocked. No password fingerprint is saved. Your on/off choice and the time of the last check stay on your device. The weak, reused, old and two-step checks never leave your device at all.
How often it runs
- Automatically, at most once a day while MoatKey is unlocked.
- When you press Check now. You can press it again after 5 minutes.
Because the results are kept only while MoatKey is unlocked, the “found in a breach” marks clear when you lock.
Turn it off
Untick Check my passwords against known breaches. MoatKey stops contacting the service and the marks disappear.
Is my password sent anywhere?
Not by Password health. “This check runs on this device. Your passwords are not sent anywhere.” If you also turn on the breach check, a 5-character piece of a fingerprint of each password, never the password, goes to the Pwned Passwords service as described above. It is off until you turn it on.
Still need help? Email support@moatkey.com.