Leaked passwords are a real risk. Cloudflare now checks yours

Password reuse is one of the most common ways an account gets compromised. If you use the same password on multiple services, a breach at one site can give attackers a working credential for another. Attackers know this and maintain large lists of known username-password pairs, using them in credential stuffing attacks against other services.

To address this, Cloudflare is rolling out a feature for the Cloudflare dashboard that checks whether the password you use to log in has appeared in a known data breach elsewhere on the Internet. The check compares your login attempt against threat intelligence feeds that track leaked credentials from other services. If a match is found, Cloudflare alerts you and asks you to choose a new password.

For users who are surprised to learn their password is compromised, Cloudflare will not lock you out immediately. The first three login attempts with a leaked password will trigger a warning. After that, Cloudflare will require a password reset before you can continue.

Resetting a compromised password is only the first step. The strongest protection for any account is two-factor authentication (2FA) via a hardware security key, an authenticator app, or passkeys. Cloudflare also allows account Super Administrators to require all members to enable 2FA.

How credentials actually leak

When you log in to a service, that provider is responsible for storing your credentials securely. Providers that follow best practices hash passwords using a cryptographic algorithm, and many add a salt—a random value prepended to each password—so that identical passwords don't produce identical hashes. These measures, combined with rate limiting on login attempts, prevent brute force attacks.

But even providers that implement these protections can fall victim to breaches. When attackers gain access to a password database, they often collect email-password pairs and try them across many other popular services to find where users have reused the same password. These credential stuffing attacks are increasingly common as more breach data accumulates, and attackers may sit on a trove of credentials for months or years before using them.

Many vendors force a password reset when they detect a compromised account. However, that only protects the account at that vendor. If you reused the same password elsewhere and don't update it in every location, you remain exposed.

What you can do to protect against leaked credentials

Unique passwords are the simplest defense. If every account you have uses a different password, a breach at one service is contained to that service. Password managers are the practical way to do this, with major operating systems now bundling them by default and third-party options available for cross-platform use.

Unique passwords alone, however, won't stop phishing. Two-factor authentication (2FA) provides protection against credential stuffing because a password alone is not enough: you also need a one-time code from an app or a tap on a physical hardware key. Adoption of 2FA, particularly hardware keys, has been shown to eliminate 99.9% of account takeovers.

How Cloudflare checks for leaked credentials

When you log in to Cloudflare, the dashboard checks whether the password you entered appears in a known data breach from another service. Cloudflare maintains hash data from breach lists, and the comparison is performed on hashed passwords—never plaintext. This has two advantages: the original password data is never readable, and hash lookups are fast enough that the check adds no noticeable latency to the login flow.

Cloudflare takes a strict approach here: it disallows a leaked credential even if the specific email-password pair doesn't match the user attempting to log in. The reasoning is practical. If a password has appeared in a breach, it's likely to be tried against Cloudflare accounts regardless of the original email it was paired with. Proactively blocking these credentials before an attacker gets to them reduces the chance that a new breach will yield a working Cloudflare login.

If a match is detected, the user sees a warning and also receives an email with a unique link to reset the password. Users are still able to log in up to three times with the compromised password before being forced to reset. To reset, navigate to the Authentication page in My Profile in the Cloudflare dashboard, select Change Password, and enter the current password plus a new, non-compromised one.

Looking ahead

Forcing password resets on compromised credentials is a useful step, but it's only part of a broader account security strategy. Cloudflare has committed to CISA's Secure by Design Pledge, which includes working to increase 2FA adoption across the industry, with plans to be shared by mid-2025.

Multi-factor authentication across every account can be cumbersome regardless of how polished the experience is. Single sign-on (SSO) eases that burden: instead of juggling many passwords and 2FA codes, you authenticate through one provider and access other services through it. Cloudflare currently limits SSO to enterprise accounts, but plans to expand this to let users log in through providers like Google and GitHub. Reducing the number of unique password and 2FA combinations you manage lowers the risk that a future breach will affect you.