How to Audit Your Saved Passwords in Chrome for Security

If you've saved passwords in Chrome for years, some are probably weak, reused or exposed in a data breach. Chrome can check them all for you, and fixing the worst ones takes less than an hour.

1. Open Google Password Manager

In Chrome, go to Settings → Autofill and passwords → Google Password Manager, or type chrome://password-manager in the address bar.

2. Run Checkup

Open Checkup. Chrome sorts your passwords into three groups:

• Compromised: found in a known data breach. Change these first.
• Reused: the same password on several sites. One breach exposes them all.
• Weak: short or easy to guess.

3. Fix them in order

1. Compromised passwords on important accounts: email, banking, shopping with saved cards, social media.
2. Reused passwords on those same accounts.
3. Everything else, a few at a time.

For each, sign in to the site, change the password, and let Chrome suggest a strong one and save it. Your email account matters most, since it can reset all the others.

4. Clean out old accounts

• Delete saved passwords for sites you no longer use.
• Better still, close those accounts, so your data isn't sitting there waiting for a breach.

5. Switch to passkeys where you can

Passkeys replace passwords with your device's screen lock. They can't be reused or phished. Many big sites offer them in their security settings, and Google Password Manager can store them.

6. Protect the password manager itself

• Turn on two-step verification for your Google account. See two-factor authentication.
• Consider on-device encryption in Password Manager settings, which encrypts your passwords with a key only you have.
• Lock your computer when you step away; anyone using it can view saved passwords after confirming your device password.

7. Check your email address too

See which breaches your email appears in. See checking if your email was in a breach.

Copying passwords

If you copy passwords instead of letting Chrome fill them, Clipboard Guard stops web pages from reading your clipboard. For other autofill risks, see browser autofill risks.

Make it a habit

Run Checkup every few months, and whenever you hear about a big breach.