Check Leaked Passwords in Chrome: Step-by-Step

This guide shows you how to use Google Chrome’s built-in password checker to find out if any of your saved passwords have been exposed in a data breach. You’ll see exactly which credentials are compromised and how to change them quickly. All you need is a computer with Chrome installed and your Google account signed in.

What You’ll Need

• Google Chrome browser (current version, updated automatically)
• A Google account signed in as the primary profile
• Saved passwords in Chrome (if you haven’t saved any, the check won’t find anything)
• An internet connection

Step-by-Step

1. Open Chrome and go to the Password Manager. Click the three-dot menu (top-right corner), then select Passwords and autofill > Google Password Manager. Alternatively, type chrome://password-manager/passwords into the address bar and press Enter.
2. Open the Checkup tab. In the left sidebar, click Checkup. This is the main dashboard that shows your overall password health.
3. Start the breach check. Look for the section labeled Compromised passwords. If it shows a number, click Review next to it. If it says “No compromised passwords found,” Chrome has already checked automatically — but you can still run a manual check by clicking Check again at the top of the page.
4. Review the list of leaked passwords. Chrome will display a list of websites and usernames whose passwords have appeared in known data breaches. Each entry will show the site name, your username, and a warning icon.
5. Change each compromised password. Click the Change password button next to an entry. Chrome will open the website’s password change page in a new tab. Follow the site’s instructions to create a new, strong password.
6. Update Chrome after changing. Once you’ve changed the password on the website, return to the Password Manager. Click the three-dot menu next to the old entry and select Edit. Enter the new password and save it. Chrome will then mark that entry as safe.
7. Repeat for all flagged entries. Go through the entire list. Chrome will refresh the count as you update each one. When all are fixed, the Compromised passwords section should show zero.
8. Check other areas of the Checkup. While you’re there, also look at Reused passwords and Weak passwords. These are not leaked, but they’re easy targets for hackers. Change them using the same process.

Common Mistakes

• Not signing in to Chrome. The password check only works when you’re signed in with your Google account. If you use Chrome without signing in, the feature is disabled.
• Checking only one device. The checkup runs on your Google account, not per device. If you check on your phone, the same results appear on your computer. Make sure you’re looking at the same account everywhere.
• Skipping the “Change password” step. Simply deleting the saved password from Chrome does not fix the leak. The website’s password is still compromised. You must change it on the actual site.
• Ignoring the “Reused” and “Weak” categories. These are not breaches, but they are high-risk. A reused password that appears in one breach exposes all your other accounts using the same password.
• Clicking “Change password” but not updating Chrome. After changing the site password, you must edit the saved entry in Chrome. Otherwise, Chrome still stores the old, compromised password.

Tips

• Use Chrome’s password generator. When you change a password, Chrome offers to create a strong, unique one. Accept it — you don’t need to memorize it, as Chrome will save it.
• Enable automatic breach alerts. Chrome automatically checks your saved passwords against known breaches and shows a warning when you visit a site that’s been compromised. Keep this feature on.
• Run the checkup regularly. Breaches happen all the time. Set a reminder to check every few months, or after you hear about a major data breach in the news.
• Use a unique password for every site. The checkup’s “Reused passwords” section helps you identify where you’ve repeated passwords. Prioritize changing those for your most important accounts (email, banking, social media).
• Consider a password manager. Chrome’s built-in manager is fine, but a dedicated manager can generate and store complex passwords across all your devices and alert you to breaches even faster.

Troubleshooting

The Checkup page shows an error or doesn’t load. Make sure you’re connected to the internet. Then sign out of your Google account in Chrome and sign back in. If that fails, restart Chrome completely (close all windows and reopen).

I don’t see the “Compromised passwords” section. This can happen if you have no saved passwords. Save at least one password first, then the checkup will work. Also, ensure Chrome is up to date — go to chrome://settings/help and let it update.

The check says “No compromised passwords” but I know I used a password that was in a breach. Chrome checks against a known list of breached passwords. If the breach is very recent or not in Google’s database, it might not show up. You can independently verify by visiting haveibeenpwned.com and entering your email address. For your password itself, you can search it in Chrome’s checkup by clicking “Check passwords” again after a few days.

I changed the password on the website, but Chrome still shows it as compromised. You need to update the saved password in Chrome. Go to the Password Manager, find the entry, click the three-dot menu, select Edit, enter the new password, and save. The warning should clear immediately.

The “Change password” button doesn’t take me to the right page. Some sites have a different URL for password changes. If the button opens a generic login page, log in manually and look for “Settings” or “Account” > “Password.” If you can’t find it, contact the site’s support.

Frequently Asked Questions

Does Chrome check all my saved passwords automatically? Yes, Chrome checks your saved passwords against known data breaches automatically when you’re signed in. The Checkup page shows the results, and you can also run a manual check anytime.

Is the password check safe? Does Chrome send my passwords to Google? Chrome uses a privacy-preserving technique called hashing. It sends an encrypted version of your password, not the plain text. Google compares it against a list of breached passwords and only returns a match if it’s found. Your actual password is never transmitted.

What does “compromised” mean exactly? A compromised password is one that has appeared in a known data breach — meaning it was exposed publicly or sold on the dark web. Anyone with that list could try it on your accounts.

How often should I check my passwords? At least once a month, or immediately after you hear about a major data breach affecting a service you use. Chrome also alerts you in real-time when you visit a site that’s been breached.

Can I check passwords on my phone? Yes. Open Chrome on your Android phone, tap the three-dot menu, select Password Manager, then Checkup. On iPhone, the feature is available in Chrome’s settings under Passwords.

What if I don’t want to save passwords in Chrome? The checkup only works for passwords saved in Chrome. If you don’t save passwords, you can still use the haveibeenpwned.com website to check your email addresses, but not your passwords directly.

Related

• Fix Delayed Text Messages on iPhone
• How to Turn Off Throttling on iPhone iOS 11.3
• Recover Missing or Deleted Bookmarks in Microsoft Edge