How to Check Whether Your Passwords Have Been Leaked (iPhone and Chrome)

Data breaches happen so often that most of us have probably had a password exposed somewhere without knowing it. The good news: the password managers built into your iPhone and your Google account already check for this, for free. Here’s how to run the check and what to do with the results.

What the Check Looks For

Both Apple and Google sort problem passwords into three groups:

• Compromised (or leaked): the password, or your username and password together, has turned up in a known data leak. These are the urgent ones.
• Reused: you use the same password on more than one account, so one breach can unlock several others.
• Weak: easy to guess, such as a single word, an obvious phrase or a simple keyboard pattern.

On an iPhone, iPad or Mac

Since iOS 18, iPadOS 18 and macOS Sequoia, Apple keeps your saved logins in a separate Passwords app. According to Apple, it alerts you when a saved password appears in known data leaks.

1. Open the Passwords app.
2. Tap or click Security.
3. Select an account flagged as weak, reused or compromised and follow the recommendation to change the password.

On iOS 17 or earlier, Apple’s path is Settings > Passwords > Security Recommendations. Turn on Detect Compromised Passwords there so your phone can keep watching for leaks.

In Chrome or With Your Google Account

Google’s Password Checkup works with any passwords saved in Google Password Manager.

1. In Chrome on a computer, select More (the three dots at the top right) > Passwords and autofill > Google Password Manager.
2. Select Checkup on the left.
3. In any other browser, go to passwords.google.com, select Go to Password Checkup, then Check passwords. You may need to sign in.

Google says compromised passwords should be changed as soon as possible. If you knowingly keep a flagged password, you can choose Dismiss warning, though that’s rarely a good idea.

What to Fix First

1. Compromised passwords on important accounts: email, banking, your Apple or Google account, and anything that stores a card.
2. Reused passwords, starting with any that match your email password.
3. Weak passwords last. Let the password manager generate a new, random one for you.

Where a site offers it, switching to a passkey removes the password problem entirely. Our guide on setting up a passkey for your Google account is a good place to start.

Running the check takes about two minutes. Doing it once a season, or any time you hear about a big breach, is a habit worth keeping.

More on Contoh

• How to Set Up a Passkey for Your Google Account
• Cybersecurity Awareness Month: Four Habits That Make You a Harder Target
• How to Turn On Stolen Device Protection on Your iPhone

Sources

• Apple Support: Use the Passwords app to create, manage, and share passwords and passkeys
• Apple Personal Safety User Guide: Manage passwords and security recommendations
• Google Account Help: Check the strength and security of your passwords