This is a bad idea, for multiple reasons.
https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...
https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...
We get a "your private data is now public" email, but knowing exactly what data turns that from a depressing statement on how much corporations value their customers' privacy into something actionable.
There seems to be some amount of entitlement by people in this thread to get information from a third party about what a first party to them lost.
The first party that lost your data should be the one that shows you exactly what was compromised.
It could show the hash instead.
>No, it's not ok that these passwords are already out there
So it's better that people have to pay for it instead of getting this information for free?
>Because it's important to say "I don't store passwords in HIBP"
This is a personal choice.
>I'm not your personal lookup service
The idea is that this would be done by the site itself and would not require manual work by the owner.
Passwords shouldn't matter anyways. Use a password manager and be done with it. The real issue is metadata which can't easily be changed - phone numbers, addresses, and the like. If any of that data is leaked, it becomes much harder to contain impact. You can't move addresses every time your address gets leaked online.