Chrome already includes most of the safety tools people go looking for: malware and phishing warnings, a password manager that checks for leaked passwords, a built-in Safety Check, controls for what each site can do, and a setting that frees up memory. Turn those on first. Add a separate extension only when it does something Chrome does not.
The short version: open Chrome’s menu (the three dots at the top right), choose Settings, then Privacy and security, and under “Safety Check” select Go to Safety Check. It reviews your passwords, Safe Browsing, updates, extensions and site permissions in one place (Google’s Safety Check help).
- Safe Browsing and Enhanced protection
- Google Password Manager and Checkup
- Safety Check and updates
- Site permissions
- Memory Saver
- Cleaning up after unwanted software
- Incognito and VPNs
Safe Browsing and Enhanced protection
Safe Browsing warns you before you open dangerous sites, downloads and extensions. Chrome has three levels: Enhanced protection, Standard protection and No protection, which Google marks as not recommended. Google describes Enhanced protection as its “most secure browsing experience”, which can warn you about dangerous sites, downloads and extensions “even ones Google didn’t previously know about” (Choose your Safe Browsing protection level).
To choose a level on a computer:
- Open Chrome and select More (the three dots at the top right), then Settings.
- On the left, select Privacy and security, then Security.
- Select the level you want.
Safe Browsing is also what blocks risky files. Chrome labels a blocked download as dangerous, suspicious, unverified (downloaded while Safe Browsing was off) or insecure (sent over a connection that is not HTTPS). With Enhanced protection on, Chrome can send a suspicious file to Google Safe Browsing to be scanned. You can still choose to keep a file after a warning, but Google asks you to take those warnings seriously (Google Chrome blocks some downloads).
Optional extra: if you want a second layer that also blocks ads and trackers, Malwarebytes Browser Guard is in the Chrome Web Store. Its listing says it blocks phishing, malware sites, tech support scams, third-party ads, trackers and hidden cryptocurrency miners. For ad blocking on its own, see our guide to ad blockers for Chrome.
Google Password Manager and Checkup
When you type a new password on a site, Chrome offers to save it. Select Save to keep it. To see, add or change saved passwords on a computer, open More, then Passwords and autofill, then Google Password Manager. Passwords saved to your Google Account can also be managed in any browser at passwords.google.com (Manage passwords in Chrome).
Inside Google Password Manager, select Checkup on the left. It checks all your saved passwords at once and tells you about any that were exposed in a data breach and any that are weak and easy to guess. Chrome can also warn you automatically when you sign in to a site with a password found in a data breach. Google says this setting is on by default; you can check it under Settings, Privacy and security, Security (How Chrome protects your passwords).
More on this in our guide to managing passwords in Chrome.
Optional extra: a separate password manager can make sense if you also use other browsers or share passwords with family or a team. Two that are live in the Chrome Web Store: Bitwarden Password Manager and 1Password.
Safety Check and updates
Google says Chrome runs Safety Check automatically, and you can run it yourself at any time. On a computer it looks for:
- Compromised, reused or weak passwords
- Your Safe Browsing status
- Available Chrome updates
- Potentially unwanted or abusive notifications
- Unused site permissions
- Potentially harmful extensions
To run it: More, Settings, Privacy and security, then under “Safety Check” select Go to Safety Check. If it finds problems, select each one and follow the steps on screen.
Updates normally happen in the background when you close and reopen Chrome. To check by hand, go to More, Help, About Google Chrome and select Relaunch if an update is waiting. No Relaunch button means you are up to date (Update Google Chrome).
To see which version you have, open More, Help, About Google Chrome. Our Chrome update guide covers every platform.
Site permissions
Site settings control what each site may use, such as your camera, microphone, location and notifications. To protect your data, Chrome also removes permissions from sites you have not used recently (Change site settings permissions).
- For one site: go to the site, select View site information (the icon to the left of the web address), then Site settings, and change the permission.
- For all sites: More, Settings, Privacy and security, Site settings, then choose the setting to change.
If a site keeps sending notifications you never wanted, this is where you turn them off.
Memory Saver
Memory Saver deactivates tabs you are not using. A deactivated tab reloads when you go back to it. To turn it on: More, Settings, Performance, turn on Memory Saver and pick a level: Moderate, Balanced (Google’s recommended level) or Maximum. On Windows, Mac and Chromebook computers with a battery, the same page has Energy Saver, which helps battery life and works when the computer is unplugged or the battery is low (Personalize Chrome performance).
No extension is needed for this. For more, see fixing high memory use in Chrome.
Cleaning up after unwanted software
If your home page or search engine keeps changing, or you see pop-ups you cannot explain, Google’s advice is to remove the unwanted program and then reset Chrome (Remove unwanted ads, pop-ups and malware):
- Windows: Start, Settings, Apps, Installed apps, select the program, then Uninstall. Mac: in Finder, open Applications, right-click the program and choose Move to Trash, then empty the Trash.
- In Chrome, go to More, Settings, Reset settings, Restore settings to their original defaults, then Reset settings.
- Turn your extensions back on one by one, and only the ones you trust.
You can also type chrome://settings into the address bar to go straight to Chrome’s settings. Our guide to removing browser hijackers goes further.
Incognito and VPNs
Incognito mode (Ctrl + Shift + N on Windows, Linux and ChromeOS, ⌘ + Shift + N on a Mac) stops Chrome from keeping your history and site data after you close all Incognito windows. Bookmarks and downloads are kept. Google is clear that it “doesn’t make you invisible”: the sites you visit, and whoever runs the network, such as your school, employer or internet provider, may still see your activity (Browse in Incognito mode).
Optional extra: if you want more than Incognito gives you, for example on public Wi-Fi, a VPN is the usual next step. Proton VPN has an extension in the Chrome Web Store. Its listing says you sign in with a Proton account, and Proton makes separate apps for Windows, Mac, iOS, Android and Linux if you want the whole device covered.
Keep your bookmarks and passwords safe
If you sign in to Chrome with your Google Account, Chrome saves things like your bookmarks and passwords to that account, so you can get them back if you change or lose a device. To sign in, select the profile icon at the top right, then Sign in to Chrome (Sign in to Chrome). This is not a backup of the files on your computer. For those, use your computer’s own backup or a backup service.
Looking for more add-ons? Browse our extension guides and privacy and security guides.