If Chrome says a password was found in a data breach, the username and password you just used, or one you saved, has been published online after a leak at some website or app. It is no longer safe. Google’s help page Manage passwords in Chrome puts it plainly: “We recommend that you change any compromised passwords as soon as you can.” Do it now, in this order:
- Change the password on the site the warning names. On a computer, Chrome may offer Change it for me (see below). Otherwise sign in to the site the usual way and change the password in its account settings. Use a new password you have never used anywhere else; Chrome can suggest a strong one and save it for you.
- Change it everywhere else you used it. Anyone with the leaked password can try it on other sites. Google says using the same password for multiple accounts puts you at greater risk of being hacked.
- If it was your Google Account password, follow Google’s steps to secure a compromised Google Account, because that one password opens your email and everything linked to it.
- Check the rest of your saved passwords. Our Password Checkup guide shows how to scan everything saved in Google Password Manager at once.
Let Chrome change it for you
On a computer, Chrome has an automated password change for some sites. When you sign in to a compatible site with a breached password, the alert says “Your password was found in a public data breach” and offers Change it for me. If it works, the dialog shows “Password changed”, and Show password reveals the new one. If it does not work, select Change it on the site and change it yourself. Do not close the tab while the change is in progress, or the password might not be updated.
Google says this needs you to be signed in to your Google Account in Chrome, with password saving turned on and at least one password saved in Google Password Manager.
Is the warning real?
Scammers imitate security warnings, so check before you act. Google’s advice for any notice about an unsafe password is to go directly to Password Checkup to make sure the notification is authentic, then change the unsafe passwords from there. Do not follow a link in a message that claims your password was leaked; open Password Checkup yourself.
On a computer, in Chrome select More (the three dots), then Passwords and autofill, then Google Password Manager, and on the left select Checkup. In another browser, go to passwords.google.com and select Go to Password Checkup, then Check passwords.
Does Google see my password?
No, according to Google’s page How Chrome protects your passwords. Chrome encrypts your username and password on your device before sending them to be compared with an encrypted list of known breached data, and Google says it “never learns your usernames or passwords during this process.”
Turn breach warnings on or off
Google says the warning is on by default, and it only works while Safe Browsing is on. With Enhanced protection it is on automatically. To switch it yourself, use Standard protection:
- Computer: select More, Settings, Privacy and security, Security, Standard protection, and turn Warn you if a password was compromised in a data breach on or off.
- Android: tap More, Settings, Privacy and security, Safe browsing, Standard protection, and turn Warn you if a password was compromised in a data breach on or off.
- iPhone and iPad: tap More, Settings, Privacy and Security, Safe Browsing, Standard Protection, and turn Warn You If Passwords Are Exposed in a Data Breach on or off.
Google Account password alerts are a separate switch: at passwords.google.com, select Settings at the top right and turn Password alerts on or off. Google says it keeps checking your passwords even with alerts off, and you might still get alerts for up to 48 hours after turning them off. We recommend leaving all of these on.
Stop warnings for an account you have closed
On a computer, open Google Password Manager and select Checkup. To the right of “Compromised passwords”, select the arrow, find the site, then select More and Dismiss warning. To bring a warning back, find it under “Dismissed warnings”, select More and then Restore warning.