> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/credentials/leaked-password.md).

# Leaked password

Stoïk Protect shows only the first and last characters of a leaked password, on purpose. This page explains why, and what to do instead.

## Why Stoïk does not share the password

* **The fix is a reset, not sharing.** Knowing the password doesn't reduce the exposure. Changing it does.
* **The password belongs to the employee, not to the company.** People reuse their passwords: this one may also open the person's personal mailbox or social networks. Handing it to their employer, or former employer, may give them the key to the person's private life, while Stoïk knows nothing about the context: a dispute, a dismissal, a conflictual resignation.
* **You don't need more to act.** The alert shows the login and the service where the password works.

## What Stoïk does and doesn't do

Stoïk does not log in manually to an account, change its password or close it. Our automated test is a single login attempt, without browsing inside the account. A manual login would add nothing to it, and we never access an account without its owner's consent.

Changing the password or closing the account ourselves would mean changing an account on someone else's service and locking its owner out, when you can get the same result yourself.

## What to do instead

In this order:

1. Ask the employee, or former employee, to change the password or close the account.
2. Otherwise, go through the domain: restore the mailbox or create a temporary alias for the address, then use "Forgot password" on the service.
3. Otherwise, contact the service's support with proof that you own the domain.

If you don't want to do anything, set the alert to Acknowledged and accept the risk.

{% hint style="warning" %}
Disabling the employee's mailbox isn't enough: the account on the other service still works for anyone who has the password.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/credentials/leaked-password.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.