Password Reuse Prevention

When you change your password, Emberly checks it against your past passwords to prevent reuse. This reduces risk from credential leaks.

How It Works

Emberly stores an encrypted history of your last 12 passwords. When you set a new password:

1. The new password is checked against your last 5 passwords
2. If it matches any, the change is rejected with an error
3. If it's unique, the change is accepted and the new hash is added to history

Older entries beyond 12 are automatically cleaned up.

What's Stored

Only bcrypt hashes are stored — never plaintext passwords. The same algorithm used for your current password is used for history entries.

Database: PasswordHistory
──────────────────────────────────
id         String (CUID primary key)
userId     String (foreign key)
password   String (bcrypt hash)
createdAt  DateTime

Error Messages

If you try to reuse a recent password:

This is shown on:

• The Profile → Security settings page when changing your password
• The Password Reset flow after clicking a reset email link

Backward Compatibility

If you created your account before this feature was added, your current password is automatically added to history the next time you log in. No action is needed.

Password Requirements

Tips for Strong Passwords

• Use a password manager to generate unique credentials for every site
• Avoid predictable patterns like Password1 → Password2
• A passphrase (correct-horse-battery-staple) is more secure and easier to remember than a short complex password
• Enable two-factor authentication for an extra layer of protection