Home Assistant Supervisor transmits first five hash characters to HIBP for password field checks since at least Supervisor 2023.1

The GitHub issue 49314 documented a user report that the pwned-passwords warning surfaced without prior opt-in after the 2026.10.1 release. Maintainer replies stated the check predates the visible warning by years, runs inside the Supervisor container, and never transmits full secrets or reversibly hashed values. The provided disable command is ha security options --pwned=false.

HIBP k-anonymity, documented in Cloudflare's 2018 post and the Wikipedia entry, limits exposure to a 16-entry range for any given prefix. Home Assistant implements the client side exactly as specified: local SHA-1, prefix-only transmission, no full hash or plaintext leaving the host. No CVE or incident report has recorded abuse of this channel against Home Assistant installations.

The operational effect is that users running the Supervisor now possess an explicit off switch previously absent from UI documentation. Installations that never mark fields as passwords or that run core-only without Supervisor remain unaffected. The incident record shows the feature activated silently for existing users once the warning renderer shipped.

Future releases will surface the same toggle in the UI; until then the CLI command remains the sole documented control. No change to the hashing or transmission logic has been committed.