Note, 18 October 2026

Private is not the same as asked

On 16 October 2026 a Home Assistant user opened an issue titled "i never authorized an integration that scans my secrets". Since 2021, on installations managed by its Supervisor, Home Assistant had been checking the passwords in its app settings against a database of leaked passwords, on by default. The passwords themselves never left the house. Nobody had asked the owner.

What happened

The issue was filed on the documentation page for the check. Its author asked how to turn the check off and suggested: "make this an opt-in feature". It was closed within twenty minutes; the project later said it had been filed against the documentation, not the software. Later that evening one of the project's developers wrote: "my earlier replies were more dismissive than this deserved. My apologies." The comment gave the command that turns the check off, ha security options --pwned=false, and said: "You are right that our documentation should have explained this, including how to turn it off." A change merged late that night added both to the documentation page: "The check is on by default."

How the check works

The Supervisor, the program that manages a Home Assistant installation and its apps, hashes each app option marked as a password with SHA-1 and sends only the first five characters of the 40-character hash to Have I Been Pwned. The service answers with the rest of every leaked hash that begins with those characters, and the match is found on the device. For "password", whose hash begins 5BAA6, the answer held 1,978 hashes when we asked on 17 October. The method is called k-anonymity; Cloudflare described its use for leaked passwords in 2018.

The service is never told which hash was yours, or whether any matched. Cloudflare's post is frank about the rest: for a password already breached, the request "can reduce the search candidates used in a brute-force attack", and a range may hold "a hash which is of substantially higher use than others". It suggests decoy queries to blur that. In the answer for 5BAA6, by our count, the hash of "password" accounts for 99.87 % of all the sightings. Very little leaves the house. Something still does, by default, day after day.

Why it surfaced in October

The check is not new: it was added in February 2021. The warning's return was. According to the pull request that fixed it, merged on 6 October 2026, a change in May 2021 had made the default configuration swallow the result: a leaked password raised no repair issue. In the code before the fix the lookups still went out; only the answers were dropped. Owners on the stable channel received the fix with Supervisor 2026.10.2 on 15 October, the day before the issue. The project's note for that release said the check "has not reported anything for a long time". In the thread the developer put it this way: "A recent release fixed the warning that surfaces it, which is why you're seeing it now."

Four questions for a device that talks on its own

Most connected products send something nobody pressed a button for: a lookup, a time request, a crash report. This one was built with care and still drew an angry issue. Four questions decide whether the owner is glad of such a call or feels caught out.

1. Did the owner hear about it before the first call?

On by default can be right for a check that protects people. Then say so where people look: on the first-run screen, and in the settings beside the switch. Home Assistant did mention the check, in one line of its March 2021 release notes and on a documentation page. Neither said it was on by default or how to turn it off. The page has said both only since 16 October.

2. What is the least that has to leave?

Write down, for each request, the bytes that leave the device and who receives them. Then make the list shorter. Five characters of a hash in place of a password is the model answer. What the receiver can still work out goes on the same list, as it does in Cloudflare's post.

3. Does the answer reach a person?

For more than five years, under the default settings, this check's findings went nowhere, because a check that says nothing looks exactly like a check that found nothing. On the bench, give the device a value you know is bad and watch the warning arrive on the owner's screen. Repeat it for every release.

4. Is the off switch where the owner looks?

The switch has existed since May 2021, on the command line. An owner who meets a check in the settings should find its switch there too, with one sentence on what turning it off gives up. And when a release changes what leaves the device, its notes should say so plainly.

A drill

Take a unit fresh from the box and record its network traffic for its first day. List every address it contacts without being asked. For each, write what leaves the device, and find the sentence the owner was shown before it did. A line with no sentence is the next issue someone will open.

All notes