I think it should be two step - checking against the list and if that passes, co...

noisy_boy on June 11, 2019 | parent | context | favorite | on: Project Svalbard: The Future of Have I Been Pwned

I think it should be two step - checking against the list and if that passes, complexity check. Covers complex passwords that are known to have been in use/leaked and non-complex ones too.