Alerts for breached websites
Firefox can warn you when a site you have a saved password for appears in a known data breach, so you can go and change that password. The warning is drawn from Mozilla’s breach data.
Not enabled in Waterfox
Waterfox ships with breach alerts off, and locked off. Checking your saved logins against a breach list means telling a third party which sites you hold accounts on. We are not willing to make that trade on your behalf, and we do not run a breach service of our own.
The relevant preferences are signon.management.page.breach-alerts.enabled and browser.urlbar.trustPanel.breachAlerts. Both are locked, so they cannot be re-enabled from Settings.
What this means in practice
- Waterfox never sends your list of saved sites anywhere.
- You will not see a warning banner in the password manager or the address bar trust panel when a site is breached.
- Nothing else about the password manager changes. Saving, filling and syncing all work normally.
Checking for breaches yourself
Breach data is public, and you can query it without a browser integration:
- Have I Been Pwned lets you check an email address against known breaches, and offers notifications when your address appears in a new one.
Doing this deliberately, when you choose, keeps the decision about who learns your account list in your hands.
What to do if a site you use is breached
- Change the password on that site immediately.
- Change it anywhere else you reused it — this is the reason not to reuse passwords in the first place.
- Use a securely generated password for the replacement so it is unique.
- Turn on two-factor authentication if the site offers it.
Related articles
- Generate a secure password in Waterfox
- Use a Primary Password to protect stored logins and passwords
- Privacy Policy
Copyright and Licensing
Adapted for Waterfox from the original Firefox article Firefox Password Manager - Alerts for breached websites. Original content by Mozilla Contributors. Licensed under the CC BY-SA 3.0.