Pwnedpassword.com cookie set on my broswer when i log in to password manager

[Billy_nich]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract:Cookie put on browser when I sign in

Detailed description: A cookie from pwnedpassword com is put on my browser when I log in to Password Manager

Product & version number:

OS details:Windows 64

What is the error message you are seeing?

If you have any supporting screenshots, please add them:

[bjm]

@Billy_nich

Pwnedpassword.com cookie set on my browser when i log in to password manager
Cookie put on browser when I sign in
A cookie from pwnedpassword com is put on my browser when I log in to Password Manager

Hello @Billy_nich
Can you confirm the exact cookie domain shown by your browser? For example, is it:

• pwnedpassword.com
• pwnedpasswords.com
• api.pwnedpasswords.com
• haveibeenpwned.com

Norton Password Manager may perform compromised-password checks, so seeing activity related to the Pwned Passwords service can be normal. The exact domain will help determine whether the cookie is expected or something unrelated.

• pwnedpasswords.com could be normal if Norton is checking passwords against breach data.
• pwnedpassword.com is not the expected domain, so we should confirm it before deciding whether it is benign, unrelated, or something that deserves further scrutiny.

I suspect you may mean pwnedpasswords.com rather than pwnedpassword.com, but can you confirm the exact cookie domain? Maybe, a screenshot would be helpful. The exact spelling matters because those would be different domains.

=============================================

Norton Password Manager integrates with Have I Been Pwned (specifically the pwnedpasswords.com service) to check whether your passwords have appeared in known data breaches.

Why the cookie appears

• When you log in to the Password Manager, it can trigger a background check against the Pwned Passwords database.
• This check loads resources from pwnedpasswords.com, which can set a cookie (usually for rate-limiting or session purposes on their end).
• The cookie is not from Norton itself — it comes from the third-party service Norton uses for breach detection.

Is it safe?

• pwnedpasswords.com is a well-known, legitimate service run by Troy Hunt.
• Norton has publicly documented using this service for its password-checking features.
• The cookie is typically harmless and short-lived.

What you can do

• If you want to avoid the cookie, you can disable the “Check for breached passwords” or similar feature in Norton Password Manager settings.
• You can also block or clear cookies from pwnedpasswords.com in your browser without affecting Norton’s core functionality.

https://haveibeenpwned.com/
https://haveibeenpwned.com/Passwords

Yes — for most people, it is considered safe to enter an email address into Have I Been Pwned.
It’s a widely respected breach-checking service created by security researcher Troy Hunt and is recommended by many cybersecurity professionals.

Even though the HIBP password checker is widely trusted in the security community, it’s still best practice not to casually type highly sensitive passwords — especially your password-manager vault/master password — into random devices or public/shared computers.

For normal site passwords, though, the service is broadly considered legitimate and widely used.
A few practical points:

• An email address is already relatively public information on the internet.
• Entering only your email address there is generally low risk.
• You should never enter:
  • your vault/master password,
  • recovery phrases,
  • MFA backup codes,
  • or banking credentials.

For the /Passwords checker specifically, the site uses a privacy-preserving hash method so the full password is not sent in plaintext.

One thing to watch for:
There are fake lookalike domains. The real official site is exactly:
https://haveibeenpwned.com
—not variations like .to, .net, extra words, or typo domains.

AI sourced content may make mistakes

[bjm]

Hello @Billy_nich

[bjm]

Hello @Billy_nich