Home Assistant users have raised concerns about a built-in security feature that checks passwords against breach databases without explicit user authorization.
The feature, part of Home Assistant’s Supervisor component, scans credentials marked as passwords in user configurations and checks them against the Have I Been Pwned (HIBP) database. According to the GitHub issue discussion, a recent software release made the warning for this check more visible, prompting users to question whether they had consented to the scanning.
One security professional expressed particular concern, stating they had not authorized integrations to scan secrets or send data “up the line,” even if hashed. They argued the feature should be opt-in rather than enabled by default, and that the mechanism could potentially be abused by malicious actors.
Home Assistant maintainers responded that the feature uses privacy-preserving techniques. According to their explanation, the Supervisor hashes passwords locally and sends only the first five characters of the SHA-1 hash to HIBP. The service returns every hash matching that prefix, and the actual matching occurs on the user’s own instance—the full passwords never leave the system.
Maintainers noted the check has existed for years as part of the Supervisor and cited k-anonymity as the privacy design principle behind it. They pointed to similar implementations by other security tools, including 1Password.
When questioned further, developers confirmed the feature can be disabled using the command ha security options --pwned=false. A maintainer later acknowledged that documentation explaining both the feature’s operation and how to disable it should have been more prominent, and committed to updating the documentation.
The exchange highlights ongoing tension between security-by-default approaches and user expectations around consent and transparency. While Home Assistant characterized the feature as privacy-preserving, critics argued that implementing such checks without explicit opt-in violates user autonomy, regardless of the technical safeguards in place.
Key facts
- Home Assistant’s Supervisor component automatically checks user passwords against the Have I Been Pwned database
- The feature hashes passwords locally and only sends the first five characters of the hash to external services
- Users can disable the check with the command
ha security options --pwned=false - The feature has been part of Home Assistant for years, but a recent update made the warning more visible
- Home Assistant developers cite k-anonymity and privacy-by-design principles in the feature’s implementation