Port request: Password Have I Been Pwned?

[izmeez]

Name of the module, theme, or layout

Password Have I Been Pwned?

The Drupal 7 module was last updated December 8, 2023 to use V3 of the HIBP API as the 7.x-2.1 release.
According to the project page 1,140 Drupal sites are shown as using this module as of November 2, 2025.
I am looking into what it may take to do this port.

Link to the drupal.org module, theme, or layout

https://www.drupal.org/project/password_haveibeenpwned

(Optional) Link to an issue in the drupal.org queue asking the Drupal community if anyone is working on a Backdrop port of this project

https://www.drupal.org/project/password_haveibeenpwned/issues/3559940

(Optional) Bounty

[izmeez]

Following from Zulip comment.

The legitimacy of the "Have I Been Pwned" HIBP website is confirmed in details I have seen from a variety of sources including this write-up that provides even more fascinating details, https://en.wikipedia.org/wiki/Have_I_Been_Pwned%3F

In addition, there are several Drupal modules that use the HIBP api: For D9 https://www.drupal.org/project/pwned_passwords, for D7 https://www.drupal.org/project/password_haveibeenpwned, and for D11 https://www.drupal.org/project/password_policy_pwned that adds it as a plugin for the password policy module. None of these appear to have been ported to Backdrop so far.

It is probably best to begin with a port of the Drupal 7 module for compatibility reasons especially for those upgrading to Backdrop CMS.

Later, it may be useful to explore how it integrates with the password policy module, https://github.com/backdrop-contrib/password_policy

[izmeez]

I have a working port of the module. I decided to rename the module to pwned_passwords like the Drupal 8/9/10 module name even though it is a port of password_haveibeenpwned 7.x-2.x module. The name is shorter and makes the code easier to read. It's in early testing so I haven't posted it. Just a heads up.

[izmeez]

The module in progress is now available at https://github.com/backdrop-contrib/pwned_passwords