Details
To help keep your account secure, our platform checks passwords against lists of commonly used and known breached passwords when they are used or created. If your password is identified as weak or potentially compromised, you may see a message asking you to update it before continuing (an example is shown below).
This does not mean your account has been compromised. In many cases, it means the password you are using is common, weak, or has appeared in a known public data breach elsewhere on the public internet.
Frequently Asked Questions
Q: Does this warning mean the platform has had a data breach?
A: No. Seeing this message does not mean our platform has had a data breach. It means the password you are using has been identified as weak, common, or previously exposed in breach data from elsewhere.
Q: Will I always be blocked from logging in?
A: Not always. In some cases, you will only see a dashboard reminder. In other cases, if stricter account security settings are enabled or your profile has been flagged, you may be required to change your password before continuing.
Q: What if I use this password on other websites?
A: You should change it there as well. If a password has been exposed or is considered unsafe, it should not be reused anywhere.
Q: How can I make my account more secure?
A: Use a strong unique password, enable 2FA, avoid shared logins, and regularly review account access and permissions.
Why You May Be Seeing This Message
You may be prompted to change your password for one of the following reasons:
- Your current password is considered weak or commonly used.
- Your password matches one found in a known public breach database.
The warning is designed to protect your profile and account by reducing the risk of unauthorised access due to reused or exposed passwords.
What You Should Do
If you see a password warning or are required to update your password, we recommend that you:
- Change your password immediately.
- Choose a strong, unique password that you do not use on any other platform.
- Update the same password anywhere else you may have used it.
- Consider using a password manager to create and store secure passwords.
- Enable SMS or app-auth two-factor authentication (2FA) for additional protection.
Where You May See These Prompts
Password security checks can appear in several places across the platform.
- After login: You may see a dashboard notification encouraging you to update your password.
- Before entering an account from the Profile page: If you have multiple accounts linked to your Profile, you will see the prompt each time you access an account if your Profile has an identified, insecure password.
- When setting a new password: The platform checks password strength and breach status during profile creation and password reset.
Enforcing Insecure Password Changes Per Account
Account Owners have the option to enforce password updates for users with affected passwords accessing specific accounts.
- Once logged into our platform, click the Account area (⚙️ icon, at top right).
- Select Security from the sidebar.
- Enable to Require users to change breached passwords option.
If this setting is enabled, Users will be blocked from accessing the account until the password has been changed. Users may still be able to access other accounts linked to their profile if those accounts do not require an immediate password update.
Creating a Strong Password
When updating your password, use one that is unique and difficult to guess.
- Avoid common words, names, or simple patterns.
- Do not reuse old passwords.
- Do not use the same password across multiple services.
- Use a password manager if you need help generating and storing secure passwords.
For broader account protection, it is also a good idea to review who has access to your account and make sure each user has their own login.
Additional Security Recommendations
As with any software platform, especially those that handle your customer data, it is important to use the security features available to you.
- Use a separate login for each user.
- Regularly review who has access to your account.
- Check user permissions and access levels.
- Enable two-factor authentication (2FA).
- Use strong, unique passwords and update them when needed.
For more general guidance, see our Security Best Practices article.
Check Whether Your Details Have Been Exposed
If you are concerned that your password may have been exposed in a broader breach, you can check publicly available breach information at Have I Been Pwned.
This service can help you identify whether your email address has appeared in known breaches and whether you should take additional action on other services.