Password hints leaked: what it means and what to do
Risk level: high. Can you change it: yes. Found in 2 breaches in this directory.
What this data is
The reminder text you typed when creating a password, meant to jog your memory if you forget it, such as my dog's name or same as bank.
The risk on its own
Hints were meant to be read only by you, and people write them accordingly. Many hints spell out the password, name its main ingredient, or give a clue a stranger can solve with a social media search. When the password itself leaked in scrambled form, the hint can be the key that unscrambles it.
The risk combined with other data
With your email address the hint points directly at a login to try. Where many users share the same scrambled password, attackers read all of their hints together to guess it, which is exactly what happened after the 2013 Adobe breach. A hint like same as email effectively hands over a second account.
How criminals use it
A hint of my first cat is solved by scrolling your public photos, and the password is the cat's name.
Hints from every user sharing the same scrambled password are read together, and the common word gives the password away.
A hint such as usual plus 1 tells an attacker you use a pattern, so they try your known passwords with small changes.
The hint names another service, so the attacker tries the same password there.
What to do now
Change the password on the breached account and on every account where you used the same password or pattern.
Use a password manager to generate and store unique passwords, so you never need a hint again.
Remove hints from any account that still lets you set them, or replace them with meaningless text.
Turn on two-factor authentication with an authenticator app on your email account first, then banking and shopping.
Check your email address with a breach checker to find other leaks where the same password might appear.
Frequently asked questions
My password was encrypted. Does the hint matter?
Yes. A hint can give away the password even when the stored copy is scrambled, because it tells an attacker what to guess.
Are password hints ever safe?
Not really. A hint useful enough to help you is usually useful to a stranger. A password manager removes the need for them.
I do not remember the hints I set. What should I do?
Assume the worst and change the password on that account and anywhere it was reused. You do not need to know the hint to fix the exposure.
Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.