Saving a password in Chrome is the easy part. The harder part — the part most users neglect until a security incident or a frustrating login failure forces the issue — is actively maintaining the credential store over time. Managing Chrome passwords means more than accepting the save prompt when it appears; it means periodically reviewing what’s stored, removing outdated credentials, resolving duplicates, running the security checkup to surface compromised or weak passwords, and understanding how the credential store interacts with Chrome sync and the Google account. If you want the full context, see our How to Manage Google Chrome.
That assumes saving works at all. If Chrome is not saving passwords in the first place, there is no credential store to maintain — start there, then come back to keep it tidy.
A credential store left unmanaged for years typically contains: multiple entries for the same site with different outdated passwords, entries for services that no longer exist, passwords that appeared in data breach databases, and a sprawl of weak reused passwords created before good password hygiene became a habit. This guide covers the audit workflow, editing and deleting credentials, handling duplicates, using the security checkup, and the password settings that affect how Chrome handles credentials.
Auditing the Chrome password store — where to start
The best entry point for any serious credential audit is the Security Checkup tool at chrome://password-manager/checkup rather than working through the full list manually. It categorises all stored credentials into three groups: Compromised (the exact username and password combination has appeared in known breach data — change immediately), Reused (the same password is used across multiple sites — any breach of one exposes all), and Weak (the password is simple regardless of breach exposure).
Working through Compromised first, then Reused, is the highest-value sequence. For each compromised credential: click the site link in the Security Checkup list, log in using the stored credential one final time, navigate to the site’s password change interface, use Chrome’s built-in password generator to create a unique strong replacement, and allow Chrome to update the saved entry. The process eliminates the specific security risk while keeping the updated credential in the managed store — future logins remain automatic.
The full credential list is at chrome://password-manager/passwords. The search bar at the top filters in real time by site name, username, or domain fragment. For a first audit of the full list, working through it systematically: credentials for defunct services should be deleted, credentials with incorrect usernames or outdated passwords should be edited, and duplicate entries for the same site should be consolidated.
Editing, deleting, and deduplicating stored credentials
Chrome menu → Settings → Autofill and passwords → Google Password Manager, or directly at chrome://password-manager/passwords. Click the three-dot menu (⋮) on any credential entry to reveal: Edit, Delete, and Copy password.
- Edit: update the username or password field → Save. The updated credential syncs to all connected devices immediately. Use this when a site password was reset externally without Chrome’s update prompt.
- Delete: confirms and removes the credential permanently from Chrome and all synced devices. Use for defunct sites, duplicate entries, and credentials that shouldn’t be stored.
- Deduplication: search the site name to surface all entries for that service at once. Identify the most current, accurate entry, verify it works by testing login, then delete the outdated duplicates. Chrome doesn’t automatically merge duplicates — each must be removed manually.
For sites where the username has changed (account migration, email address change): rather than editing the username on an existing entry, it’s often cleaner to delete the old entry and allow Chrome to save the new credential on the next login — this ensures the entry is captured correctly from the actual login form rather than typed manually with potential errors.
Bulk operations aren’t available through Chrome’s password manager interface — entries are handled one at a time. For users with hundreds of outdated credentials to clear: export the credential list as a CSV, edit it in a spreadsheet application to remove unwanted rows, then compare the cleaned version with the existing store. The export-edit workflow is more complex than individual deletion but significantly faster when the cleanup scope is large. Export from the settings gear icon in the password manager.
Chrome password management — feature comparison
| Task | Via Chrome Password Manager | Via passwords.google.com |
| View all saved passwords | chrome://password-manager/passwords | Full list with same search |
| Edit a credential | Three-dot menu → Edit | Click entry → Edit |
| Delete a credential | Three-dot menu → Delete | Click entry → Delete |
| Security Checkup | chrome://password-manager/checkup | Dedicated Checkup tab on page |
| Export all credentials | Settings gear → Export | Settings → Export |
| Import from CSV | Settings gear → Import | Settings → Import |
| Access on non-Chrome browser | Not available | Full access via any browser |
The passwords.google.com web interface provides an alternative path from any browser on any device — particularly useful when Chrome isn’t available or when managing the credential store from a mobile device where the Chrome Settings interface is less comfortable than a full web page. All operations available in the Chrome browser password manager are also available on the web interface, and the two are fully synchronised within seconds.
Managing passwords across multiple Google accounts
Each Chrome profile signed in to a different Google account maintains its own independent credential store. The password manager accessed from each profile shows only that profile’s stored passwords. A password saved while the work profile is active lands in the work account’s credential store, not the personal account’s — which can cause autofill gaps when logging in to personal sites from the work profile or vice versa.
There’s no cross-profile credential sharing within Chrome’s built-in password manager. Users who need credentials available regardless of which profile is active typically export from one profile, import into the other, and maintain both stores in sync through periodic re-export and re-import — a manual process that dedicated password managers like Bitwarden, 1Password, or Dashlane handle more elegantly through centralised storage independent of the browser profile system.
Our guide on Chrome’s password manager covers the feature overview and the generator, and our guide on Chrome sync covers the account configuration that makes the credential store consistent across all devices. For passkey management and the end-to-end encryption option for stored credentials, Google’s Chrome password documentation covers the implementation details and privacy model.
Password settings that affect credential handling
Several Chrome settings affect credential-handling behaviour independently of the password manager interface:
- “Offer to save passwords” (Settings → Autofill and passwords → Google Password Manager → Settings): toggle off to stop Chrome from showing the save prompt for new credentials. Appropriate for users who have migrated to a dedicated password manager and want Chrome to stop prompting without deleting the existing store immediately.
- “Auto sign-in”: when on, Chrome automatically fills and submits credentials on sites with a single stored account. Turning it off means Chrome fills fields but waits for manual submission — useful for verifying the correct credential is being used before login proceeds.
- “Check if passwords are compromised”: enables Chrome’s ongoing background monitoring against Google’s breach database — the mechanism that produces inline breach warnings during logins and Security Checkup findings. There’s no compelling reason to disable this; the monitoring runs locally using a privacy-preserving protocol and Google doesn’t receive the actual passwords to check.
- Never saved sites: clicking “Never” on a save prompt adds the site to a suppression list. Review this at Settings → Google Password Manager → Settings → Declined sites. Sites mistakenly added will never prompt for credential saving — removing them from this list restores normal save prompt behaviour.
Practical routines for ongoing maintenance
The most effective approach isn’t a single annual cleanup but a lightweight recurring habit that prevents the credential store from becoming a liability. A monthly five-minute routine:
- Open chrome://password-manager/checkup and address any new Compromised entries
- In the Reused section, change the password on at least one reused credential using the password generator — prioritise financial services, email, and work accounts
- Delete one or two obviously outdated entries from the full list — defunct accounts, test logins, replaced services
The Reused passwords section is often the largest category for users who have been saving credentials in Chrome for years without active management. Reused passwords are the most consequential security issue in most credential stores: a single breached site exposes every other site sharing that password. Addressing this category systematically — changing reused passwords on the most sensitive sites first — reduces the blast radius of any future credential exposure. Chrome’s password generator, always available when changing a password on any site, makes replacing reused passwords with unique strong ones entirely automatic. With consistent monthly attention, the Reused category shrinks steadily until each credential in the store is unique.
A note on passkeys stored in Chrome: they appear in the same passwords.google.com interface alongside traditional credentials but behave differently. A passkey can’t be exported as a plain text string; they’re cryptographic key pairs tied to the device and account that created them. Before deleting any passkey entry, verify that an alternative login method (email, backup code, or traditional password) is still active on the associated account — deleting a passkey for an account with no backup authentication makes recovery difficult.
The credential store reflects your security posture in a meaningful way. A well-maintained store where every credential is unique, up-to-date, and breach-monitored is one of the highest-value security habits available to any internet user — protecting dozens of accounts with minimal ongoing effort once the monthly review habit is established.
The decision between Chrome’s built-in tools and a dedicated manager
Chrome’s password manager covers the core needs — saving, filling, generating, and auditing — at no cost with excellent browser integration. Dedicated managers like Bitwarden, 1Password, or Dashlane add secure notes, cross-browser access, family or team sharing, and more granular organisation. The comparison:
- Use Chrome’s built-in tools if: you browse exclusively on Chrome across all devices, you don’t need to share credentials with others, and you don’t store sensitive non-credential information (software licence keys, secure notes)
- Consider migrating to a dedicated manager if: you regularly use multiple browsers, you share accounts with family members or team members, you want cross-browser access to credentials, or you need to store non-credential sensitive data alongside passwords
The migration path from Chrome’s manager to a dedicated tool is clean: export the credential store as CSV via the settings gear icon in chrome://password-manager/passwords, import the CSV into the dedicated manager, verify everything transferred correctly, then disable Chrome’s “Offer to save passwords” setting to prevent the two stores from diverging going forward. The reverse (migrating from a dedicated manager back to Chrome) is equally straightforward — most dedicated managers support CSV export in a format Chrome can import.
Complete credential store reset
For users who decide the credential store needs a complete reset — after a major security incident, after a significant life change like an email address change, or after migrating to a dedicated password manager — a controlled reset workflow:
- Export the full credential store as CSV via the gear icon in chrome://password-manager (keep this as a backup)
- Delete credentials in batches by searching the first letter of site names (“a” shows all sites starting with A, etc.) and deleting each group — there’s no “delete all” button but alphabetical batching is faster than individual deletion
- When the store is empty, allow Chrome to save only the credentials you encounter and consciously choose to save going forward
This approach gives you a clean slate without losing access to the credentials you still need during the transition — the CSV export is the safety net that allows reverting any specific credential if needed.
Monitoring newly compromised credentials
Chrome’s background breach monitoring runs continuously and surfaces new findings in two ways: the Security Checkup page (chrome://password-manager/checkup) updates automatically as Google’s breach database receives new data, and inline warnings appear directly in the password field when visiting a site where the stored credential has appeared in a newly reported breach. These inline warnings are particularly effective for catching newly exposed credentials between full monthly reviews — acting on them immediately when they appear is more responsive than waiting for the next scheduled audit.
When an inline warning appears during login: the site hasn’t been hacked and your account hasn’t necessarily been accessed — the warning means the specific username and password combination exists in data that was stolen from some service. The appropriate response is to change the password for that site immediately, using the generator to create a unique replacement. If the same password was used elsewhere: check the Reused section of the Security Checkup to identify all affected sites and change those passwords too.
Chrome’s credential management tools, used consistently, transform password security from a static snapshot taken at account creation to a living system that monitors, surfaces, and facilitates resolution of security issues as they emerge. The monthly review habit, combined with Chrome’s automatic background monitoring, provides a level of credential security that most users think requires a dedicated security subscription to achieve. It’s built-in, it’s free, and it works — the only input required is the habit of actually using it. See also Fix Chrome Sync Not Working for a related case.
