Do you trust them to salt and hash your password using bcrypt? (rather than store it in plain text). Do you use a password manager to generate strong passwords that are at least 16 chars long? If you can answer yes to both, then it doesn't actually matter if your hashed password was part of a breach or not, the hackers won't be able to brute force it. (Of course if hackers manage to steal the private key with which your session cookie is encrypted, they can still log in as you - but then changing your password won't help either).

This seems reasonable. How often do you change you passwords? Feels like it would get extremely tedious if you have more then a few accounts though, no?

My current work forces updates every 3 months. It seems more like a security issue requiring this reset so often.

This is because they create another problem when anyone you talk to will say they have their password and just increment a number for every password change. That way they’re not having to remember a whole new password every few months. So there’s never much of a change in anyones password during these rotations.

- abcde1 - abcde2 - abcde3 - …

I think the question is do people naturally change old passwords without such policies.

The policies are the problem and the industry has recognized it so they’ve moved away from those recommendations.

NIST actually changed their recommendation relatively recently and no longer suggests periodic password changes without reason.

> Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Source: https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver