frenck commented on Oct 16, 2026
Leaving this closed since this repository is for our documentation, but I want to follow up, because my earlier replies were more dismissive than this deserved. My apologies.
As it turns out, this check can already be turned off after all:
ha security options --pwned=false
To be transparent: this check isn’t new, it has been part of the Supervisor for years. It checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why you’re seeing it now.
Privacy was a design requirement for this feature from the start, which is why your secrets never leave your system. The Supervisor hashes them locally and sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned. HIBP returns every hash starting with that prefix, and the matching happens on your own instance. You can see exactly what it does here: https://github.com/home-assistant/supervisor/blob/main/supervisor/utils/pwned.py
You are right that our documentation should have explained this, including how to turn it off. We’ll get that page updated.
../Frenck
Blogging my personal ramblings at frenck.dev
