Passwords are still the weakest link in online security, not because they are bad, but because people reuse them. When one website where you have an account gets hacked, your password ends up on huge lists that criminals then try against other services. That technique is called credential stuffing and it is the most common way accounts get taken over today. So we gave Planninn an extra layer of protection.
What we do now
Every time you create an account or change your password, Planninn compares that password in the background against known data breaches. If it appears in one, we send you a single friendly message advising you to change it. That's all, you are never locked out and we block nothing. It's advice and we are not enforcing anything.
How the check protects your privacy
This is the important part: your actual password never leaves Planninn. We use a privacy-preserving method (k-anonymity) in which we create an encrypted fingerprint of your password locally and share only its first five characters with the breach database Have I Been Pwned. That database returns hundreds of possible matches, and Planninn checks locally whether yours is among them. That's how we learn there's a match without anyone ever seeing your password.
What we deliberately do not do
We never store your password in readable form, only as an irreversible, encrypted hash (bcrypt). That is exactly as it should be because even we cannot read your password. It also means we can't retroactively scan existing passwords. The check works from now on at registration and on every change. That's a deliberate choice in your favour.
What you can do
- Use a unique password for Planninn that you don't use anywhere else.
- Consider a password manager like for example NordPass, it creates and remembers a different strong password for every site.
- Add a (biometric) passkey (Face ID, fingerprint or Windows Hello) under Profile → Security, for login that can't be phished.
- Curious which of your accounts have been caught in breaches? Check your email address for free at haveibeenpwned.com.
Frequently asked questions
Was Planninn hacked?
No. This check is about passwords that leaked from other websites and that you may have reused. Your Planninn account was not broken into and we were not hacked.
Can you see my password?
No. Your password is encrypted locally and never leaves Planninn in readable form. We share only a short, partial fingerprint with the breach database.
Will I be locked out if my password is in a breach?
No. You get one advice email; nothing else about your access changes. It's a tip, not a block.
Why don't you check my current password?
Because we don't store it in readable form (and don't want to). The check works from now on, for new and changed passwords.
Would planninn ever request me to provide my password ?
No. We will never ask for your credentials. Not via email, not via phone, social media etc. If this happends please contact us and share the suspicious requests so that we can investigate and contact the proper authorities.
Written by Jos Vervoorn, Planninn (IT-Consolidated B.V.). Reviewed September 2026.