Prevent weak and compromised passwords in your Bubble app by checking them against the "Have I Been Pwned" (HIBP) breached password database using the k-Anonymity model. This plugin securely hashes passwords on the client using the Web Crypto API, ensuring that plaintext data never leaves the user’s browser.
Perfect for sign-up forms, password resets, or security-focused applications.


1. Drop the “HIBP Checker” plugin element onto your page.

2. Use the plugin's “Check Password” action in a workflow and pass in the user’s password input.

3. Use the exposed isBreached state to block weak or compromised passwords.

4. Trigger follow-up logic using the built-in Password Checked event.


The plugin runs fully client-side and uses SHA-1 hashing via Web Crypto and HIBP’s k-Anonymity model to ensure privacy and performance.