Check all KeePass passwords against the Have I Been Pwned database locally

KeePass users can do the same, but locally. Here is what is needed for that:

You need a copy of KeePass - https://keepass.info/
Download the latest version of the KeePass plugin HIPB Offline Check - https://github.com/mihaifm/HIBPOfflineCheck
KeePass supports lots of plugins that may improve security and other functionality - (see) https://www.ghacks.net/2012/04/08/keepass-plugins-that-improve-the-password-managers-functionality/
Download the latest SHA-1 (ordered by hash) password database file from Have I Been Pwned - (site) https://haveibeenpwned.com/Passwords

Place the plugin file in the KeePass plugin folder. The plugin is open source and you may build it from scratch and vet it if you have the skills.

Installed copies of KeePass are found under C:\Program Files (x86)\KeePass by default.

Extract the password database file and place it somewhere on the system. Note that it has a size of 23 Gigabytes in plain text format right now, the download has a size of roughly 9 Gigabytes.

Start the KeePass password manager afterward and select Tools > HIBP Offline Check in the program's interface. Click on Browse and select the password database file that you extracted to the system.

You may change other parameters, e.g. the column name in KeePass or the text that is displayed for secure and insecure passwords.

Last but not least, select View > Configure Columns, and activate the Have I Been Pwned column to display the findings of the check in the interface.
Checking KeePass passwords against the Have I Been Pwned database

keepass password check

You have multiple options to check passwords against the database file.

- Double-click on the password field of any entry to check it.
- Select multiple items, right-click on the selection and pick Selected Entries > Have I Been Pwned database.

The plugin checks any updated password against the database automatically. The plugin checks the password's hash against the hash database to determine if it has been leaked.

A hit does not necessarily mean that the password is known to third-parties as it depends on the password's strength and the capabilities of the third-party to decrypt it.