Bring the full protection of Have I Been Pwned to your Active Directory
Have I Been Pwned is arguably one of the world's most comprehensive sources of publicly breached passwords, and if the defenders can find them, so can the attackers. Lithnet Password Protection can sync an offline copy of the full Have I Been Pwned data set into your environment, so no user in your Active Directory can choose a password that's in it.
Support plans from USD 750 a year, including 300 usersFree for every organization
New password
Summer2026!
- Found in the Have I Been Pwned data set
- Built on a banned word: summer
- Meets your length and complexity policy
Password rejected
We built Have I Been Pwned right into Password Protection
The complete data set, on your own network
Password Protection downloads the complete Have I Been Pwned password data for you and keeps it on your own network.
Easy to keep current as new breaches appear
When Have I Been Pwned adds passwords from new breaches, you can bring your copy up to date as often as you like. Password Protection blocks the new passwords from then on.
Full protection without internet access
Even if your network has no internet access at all, you can download the data on another computer and import it from there.
You are in control of your breached password list
Lithnet Password Protection allows you to bring in breached passwords from any source. Be it Have I Been Pwned, your own security provider, or passwords you have found yourself, you're in control of the passwords used in your environment.
Find users who already have a breached password
Not only can Password Protection prevent users from selecting compromised passwords, it also allows you to audit your directory on demand. The audit checks your users' current passwords against your compromised password lists and shows you which accounts need a new password. You can then ask those users to change their password or require a change at their next logon.
Give Active Directory the blocklist check that NIST requires
NIST SP 800-63B revision 4, section 3.1.1.2, requires that every new password is checked against a blocklist of commonly used, expected or compromised passwords. Active Directory cannot achieve this on its own, but Lithnet Password Protection allows you to meet this requirement with ease.
Already using Microsoft Entra Password Protection?
Microsoft Entra Password Protection checks passwords against Microsoft's own global banned list and up to 1,000 terms that you add. The banned list isn't configurable and as such it doesn't include breached password lists such as Have I Been Pwned.
With Lithnet Password Protection, you decide which passwords are a risk to you. You build your data set from the sources you choose, such as the Have I Been Pwned list, breach lists from your SOC or security partners, or passwords you find yourself.
You don't have to give up Entra Password Protection to use Lithnet Password Protection. It's fully supported to run both products at the same time.
Compare with Entra Password ProtectionMicrosoft LearnFrequently asked questions
Does the filter send passwords or hashes to Have I Been Pwned?
No. Lithnet Password Protection allows you to synchronize an offline copy of the Have I Been Pwned data set. Password checks happen against your own copy of the data.
How do we keep the Have I Been Pwned list up to date?
Lithnet Password Protection provides a PowerShell module that allows you to manage your password lists. It uses intelligent delta syncing technology that will search the Have I Been Pwned store for changes, and only bring in new data.
Which Windows Server versions does it support?
Password Protection runs on x64 domain controllers with Windows Server 2016 or later.
Get started today
Support plans start at USD 750 a year, including 300 users. Lithnet Password Protection runs on your domain controllers, and a support plan ensures you have help available directly from Lithnet when you need it. We're there to help troubleshoot problems, provide advice, and ensure you are first to be notified about security fixes.