---
title: "Password health and at-risk reports"
description: "Find weak, reused, stale, and breached passwords, and when someone leaves, list every credential they saw or could reach that still needs changing."
url: "https://support.outpostplatform.com/documentation/password-health/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Credential health in the Outpost console (Weak, Reused, Not rotated, Breached, No second factor, Insecure address, Not linked to anything), checked every six hours, and the Credential health, Termination, and Still at risk reports for offboarding. Breach checks send only a hash prefix and do not run on Remote Outpost. Needs vault:read; departure reports need vault:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "vault:read"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/documentation/password-health.md"
license: "CC BY 4.0"
---

# Password health and at-risk reports

Outpost checks every stored password for the problems that get accounts taken
over, and when a team member leaves, it lists exactly which credentials they
saw and which they could have seen. This page shows how to find unhealthy
passwords and how to run the departure reports so nothing a former colleague
knew stays unchanged.

## Before you begin

- Reading credential health needs `vault:read`. The departure reports need
  `vault:manage`.
- On the MSP plan, these reports run across every client. A client that cannot
  be reached is named on the report, so a missing client is never read as a
  clean one.

## What Outpost checks

Outpost scores a password's strength when it is saved, and checks the whole
vault every six hours. Each finding shows as its own chip.

| Finding | Means |
| --- | --- |
| **Breached** | The password appears in a public corpus of breached passwords. Raises a critical alert. |
| **Reused** | Another credential in the same client has the same password. Clients are never compared with each other. |
| **Weak** | The strength score is **Very weak** or **Weak**. |
| **Not rotated** | Nobody has changed the password in longer than **A credential is stale after, days**, 365 by default. A password never changed is measured from when it was created. |
| **Insecure address** | One of its web addresses uses `http://`, so the password crosses the network unencrypted when used. |
| **No second factor** | A **Login** with a web address and no one-time code stored. |
| **Not linked to anything** | No password is stored on the credential, which often happens with imported credentials that need a value. |

A retired credential has no findings.

The breach check sends only the first characters of a hash of the password to
the breach corpus, never the password. It needs the internet, so it does not
run on a Remote Outpost, and an administrator can turn it off with **Check
stored passwords against known breaches** in **Documentation** > **Settings**.
When it has not run, a credential's breach status reads **Not checked**, never
clean.

## Find unhealthy credentials

- The Documentation **Overview** counts **credentials flagged**. Select it to
  open the credential list.
- The Documentation **Overview** also links **Password health**, a page that
  lists every stored password and what is wrong with it. The link is shown to
  holders of `vault:read`.
- In **Credentials**, the **Health** column shows each credential's worst
  finding.
- On a credential, the **Health** card lists every finding, the **Strength**,
  and the breach result, such as **Not in the breach corpus** or **Seen 3
  times in breaches**.

## Run the Credential health report

1. Go to **Reports** > **All reports**.
2. Select **Credential health**. The report lists every credential with its
   collection, kind, strength, breach count, findings, last rotation, and
   whether checkout is on. It never includes a secret.
3. Select **Download PDF** or **Download CSV**.

To receive it regularly, schedule it. See
[Run and schedule reports](/reports/run-and-schedule/).

## Offboard someone who has left

Disable the person's console account first, so they cannot reveal anything
more. Then run the two departure
reports. Both list only what the vault knows about, so a password the person
learned some other way is not on them.

### Termination report

The termination report answers what one person saw, what they could have seen,
and what has already been changed since. Open it from **Termination report**
on the Documentation **Overview**, shown to holders of `vault:manage`.

1. In **The person**, choose who left. Anyone who has ever held access is
   listed, including disabled accounts.
2. In **How far back**, choose **The last 30 days**, **The last 90 days**,
   **The last year**, or **Everything on record**. To set dates instead, use
   **Or from this date** and **Until**.
3. Select **Run it**.

The report has two tables. The first is everything the person disclosed: each
reveal, use, one-time code read, previous value read, and export. The second is the credentials they had access to
and never opened. A grant that was never used is still a grant, so rotate
those too. Select **Download the PDF** for an auditor or **Download the CSV**
to work from.

### Still at risk

**Still at risk** is the termination report with the finished work removed: the
credentials the person could reach that nobody has changed since. Open it from
**Still at risk** on the Documentation **Overview**, shown to holders of
`vault:manage`.

1. In **The person**, choose who left.
2. Select **Run it**.
3. Change each credential listed under **Still to change**.
4. Run it again. When the list is empty, the page says **Nothing this person
   could reach is still unchanged. The offboarding is complete.**

**Credentials at risk after a departure** in **Reports** > **All reports** runs
the same check for everyone who has left, and can be scheduled as a regular
sweep.

## Verify

Run **Still at risk** for the person. The offboarding is done when it reports
nothing still unchanged and names no client it could not reach.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| Every credential's breach status is **Not checked**. | Breach checking is off, or this is a Remote Outpost. | Turn on **Check stored passwords against known breaches**, or accept that offline Depots cannot check. |
| A report names a client that **could not be reached**. | That client's database did not answer during the run. | Run the report again later. Nothing from that client is in this run. |
| The departure reports are unavailable. | You lack `vault:manage`. | Ask an administrator. |

## Next steps

- [Credentials vault](/documentation/credentials-vault/)
- [Report datasets](/reports/datasets/)