How Firefox Alerts Users of Breached Passwords

This article provides a comprehensive overview of how the Firefox web browser protects your online accounts by integrating its built-in password manager with Mozilla Monitor. Below, you will learn the exact mechanics of how Firefox detects if your saved credentials have been involved in a known data breach, the privacy measures used to keep your data safe during this process, and what the visual alerts look like inside the browser so you can take immediate action to secure your accounts.

The Connection Between Firefox and Mozilla Monitor

Firefox features a built-in password manager that securely stores your usernames and passwords. To keep these credentials safe, Firefox integrates directly with Mozilla Monitor, a security service powered by the "Have I Been Pwned" database, which tracks publicly known data breaches.

Firefox automatically cross-references your saved logins with this database to determine if an account you use has been compromised.

How Firefox Checks Your Passwords Privately

Mozilla does not send your actual usernames or passwords over the internet to check for breaches. Instead, Firefox uses a privacy-preserving method to verify your data locally on your device:

  1. Encrypted Database Download: Firefox periodically downloads a list of known website breaches from Mozilla Monitor.
  2. Local Comparison: The browser checks the websites and email addresses stored in your password manager against this downloaded list directly on your computer.
  3. Timeline Verification: Firefox checks the date of the data breach against the date you last updated your password for that specific site. If the breach occurred before you saved or changed your password, Firefox will not alert you. If the breach happened after you saved the password, Firefox triggers an alert.

How the Alerts Appear in Firefox

When Firefox detects that one of your saved logins was involved in a data breach, it notifies you through its password management page (accessible by typing about:logins into the address bar or selecting Passwords from the main menu).

You will see the following visual indicators:

  • Red Warning Icon: In the list of your saved accounts on the left side of the screen, a red triangle with an exclamation mark will appear next to the compromised website.
  • Breach Banner: When you click on the affected login, a prominent red banner appears at the top of the account details. This banner explicitly states, "This website was in a data breach," and provides the date the breach occurred.
  • Direct Link to Resolve: The alert banner includes a direct link to the breached website, allowing you to navigate there immediately to change your password.

Alerts for Reused Compromised Passwords

If a password exposed in a data breach is also being used for other accounts saved in your browser, Firefox will flag those secondary accounts as well.

Next to those accounts, you will see a yellow warning icon and a message stating that the password is "Vulnerable." Firefox alerts you to change these passwords immediately, as hackers often use credentials leaked from one site to break into accounts on other websites.

How to Ensure Breach Alerts Are Enabled

Breach alerts are turned on by default in Firefox, but you can verify that the feature is active by following these steps:

  1. Click the menu button (three horizontal lines) in the top right corner of Firefox and select Settings.
  2. Click on Privacy & Security in the left-hand menu.
  3. Scroll down to the Logins and Passwords section.
  4. Ensure the box next to Show alerts about passwords for breached websites is checked.