Docs / Obsidian Vault / Staying safe
The security dashboard
Open Security dashboard under Tools. It checks every saved login and gives your vault a score out of 100, with a list of things to fix, worst first. Everything is worked out on your own device from your decrypted vault: your passwords are never sent anywhere to be checked.
What it looks for
| Finding | What it means | What to do |
|---|---|---|
| Exposed in data breaches | The password turns up in known data breaches, so attackers have it on their lists. | Change it first, on the site and in the vault. |
| Weak | The password is easy to guess. | Change it to a generated one. |
| Reused | The same password is used for more than one login. If one site is breached, the others are open. | Give each site its own password. |
| Old | The password hasn't been changed for more than a year. | Change it when convenient. |
| Insecure websites | The login is saved for an address starting with http://, which sends your password unencrypted. | Check whether the site has an https:// address and change the saved one. |
| Two-step login available | The site offers two-step login with a verification code and you haven't set it up for this login. | Turn it on at the site and keep the code in the item (see Verification codes). |
Each finding has a Fix button that opens the item for editing, with the generator one click away. Fixing anything never lowers your score.
The breach check
The breach check uses Have I Been Pwned without sending your password. Your device turns each password into a one-way hash and sends only the first 5 characters of it. The answer is the list of all breached passwords that start with those 5 characters, and your device looks for a match itself. Nobody, not us and not Have I Been Pwned, learns the password.
Checking for breached passwords is part of Premium.
The score
Every login with a password adds risk points for its findings (an exposed password counts most, then weak and reused, then old, insecure and missing two-step login), and the score is 100 minus the average. One exposed password among ten logins costs 10 points. The same vault shows the same score in the web vault, the extension and the apps.