Reusing the same password across multiple sites is one of the most common and most dangerous habits in everyday digital life — when one of those sites is breached, every other account sharing that password becomes vulnerable immediately. The Chrome password manager is the most frictionless available solution to this problem for most people, precisely because it requires nothing new to install, nothing to learn beyond what you already do, and no monthly subscription. If you want the full context, see our How to Manage Google Chrome.
Built into every Chrome installation and synced across all devices connected to the same Google account, it captures credentials automatically when you log in or sign up, fills them on return visits without manual entry, generates strong unique passwords for new accounts, and periodically checks whether any stored password has appeared in a publicly reported data breach. For someone who currently has no password management system at all, it’s a dramatic and immediate improvement in both security and convenience.
Where to find it and what it stores
Three access routes depending on context:
- chrome://password-manager/passwords — type this directly in the address bar for the fastest route to the full credential list
- Chrome menu → Settings → Autofill and passwords → Google Password Manager — the Settings path when adjusting configuration
- The key icon in the address bar — appears when a password field is active, opens the credential for that site directly
What the manager stores is broader than most users realise. Beyond traditional username/password pairs, it also stores passkeys — the newer cryptographic authentication credentials that Google, Apple, Microsoft, GitHub, and an increasing number of services use as a password replacement. Passkeys stored here are tied to the Google account and work across all synced devices without any user configuration required.
What it doesn’t store: secure notes, software licence keys, or other non-credential sensitive information. This is the main distinguishing limitation compared to dedicated tools like 1Password or Bitwarden. The credential store is also accessible via passwords.google.com from any browser — a useful fallback when Chrome itself isn’t available.
Credentials are encrypted before leaving the device when sync is active, stored on Google’s servers in encrypted form. Google holds the encryption keys by default, meaning Google can technically access the decrypted data. The passphrase option — covered at the end of this guide — changes this to user-held encryption that Google can’t decrypt.
How saving and autofilling work in practice
The manager captures credentials at two moments: when a login form is submitted with credentials Chrome hasn’t seen before for that site, and when a new account sign-up form is completed. In both cases, a banner appears at the top of the page on desktop (or a bottom sheet on mobile) asking whether to save the password. Click Save and the credentials sync to all connected devices within seconds. Click Never and that site is removed from future save prompts permanently — a choice that’s reversible from Settings but easy to trigger accidentally.
If that banner never appears — or the manager has stopped offering to save or fill anything — work through the dedicated guide for when the Chrome password manager has stopped working, which covers the toggle, sync, and site-detection causes in order.
On return visits, autofill is designed to be immediate and invisible. When Chrome detects a login form on a page where credentials are stored, it automatically populates both fields. On sites where multiple accounts are saved (a personal and work email for the same service, for example), Chrome populates with the most recently used credential and shows a dropdown suggesting alternatives when the user clicks the field — navigable with arrow keys and selectable with Enter, no mouse required.
When autofill doesn’t trigger automatically — this occasionally happens on sites with non-standard login forms — the key icon that appears in the password field opens the credential picker manually. Editing a saved credential: find the site in the credential list → click the three-dot menu or the entry itself → Edit → make changes → save. The update syncs immediately to all connected devices. This editing path is essential after a password reset — Chrome will typically notice and offer to update the saved credential automatically, but if that prompt is missed, the manual edit handles it.
Password generator and Security Checkup
The password generator activates automatically when Chrome detects a new account sign-up form or a password reset field. A “Suggest strong password” prompt appears inside the password field — clicking it inserts a generated password (typically 15-20 characters combining upper and lowercase letters, numbers, and symbols) and simultaneously offers to save it. Using the generator for every new account is the single most impactful action available for improving account security: every account gets a unique, strong password that’s unguessable and not shared with any other service.
The Security Checkup feature — accessible from the main interface under “Check passwords” or at chrome://password-manager/checkup — analyses all stored credentials against Google’s database of known compromised password-site combinations from publicly reported breaches. It categorises findings into three groups:
- Compromised: the exact username and password combination has appeared in breach data — change immediately
- Weak: the password is too simple regardless of breach exposure
- Reused: the same password is used across multiple sites — a breach of any one exposes all others
Running Security Checkup monthly is the maintenance habit that preserves the security value of any password manager over time. A credential store that was fully secure twelve months ago may contain newly compromised entries today. When the checkup identifies a compromised credential: visit the site, change the password using the generator, allow Chrome to save the replacement. Under two minutes per credential.
Exporting, importing, and migrating credentials
Exporting to a CSV file: click the Settings icon (gear symbol) within the password manager → “Export passwords” → authenticate with device PIN or biometric → choose a save location. The exported CSV contains the site URL, username, and plaintext password for every entry. This file is extremely sensitive — every stored password in readable plaintext. Don’t store it in the Downloads folder, share via unencrypted channels, or leave it accessible after use. Use it for its intended purpose (migration, audit, backup) and then securely delete it.
Importing from a CSV file or from another browser: Settings icon → “Import passwords” → select the CSV file. Chrome accepts the standard password CSV format used by most browsers and many dedicated password managers (Firefox, Edge, Safari, LastPass, Bitwarden all export in compatible format). After a large import, run Security Checkup immediately — imported credentials may include old weak or reused passwords that the generator-based approach would have prevented.
Our guide on Chrome sync covers the account setup that makes the password manager work across devices, and our guide on Chrome Incognito mode covers why Incognito doesn’t save passwords (intentional — the private session doesn’t persist to the credential store). For passkey technical implementation and the growing list of services supporting them, passkeys.dev covers the spec and compatible service directory.
Chrome password manager vs dedicated alternatives
The decision between Chrome’s built-in manager and a dedicated tool like 1Password, Bitwarden, or Dashlane reduces to three questions:
- Do you need cross-browser access? Dedicated tools work across all browsers. Chrome’s manager requires Chrome or passwords.google.com.
- Do you need secure note storage? Dedicated tools store non-credential sensitive data (software keys, secure notes, Wi-Fi passwords). Chrome doesn’t.
- Do you need team or family credential sharing? Dedicated tools have structured sharing with permission management. Chrome’s sharing is limited to the same Google account.
For a solo user on Chrome across all devices with none of these specific needs, the built-in manager covers every essential use case without cost or additional software. For anyone who uses Firefox or Safari alongside Chrome, or who has non-password credentials to protect, the dedicated tools earn their subscription cost.
| Feature | Chrome password manager | Dedicated (e.g. Bitwarden) |
| Cost | Free | Free–$3/month |
| Cross-browser | No (Chrome / passwords.google.com) | Yes (all browsers) |
| Secure notes | No | Yes |
| Family/team sharing | No | Yes |
| Password generator | Yes | Yes |
| Breach monitoring | Yes (Security Checkup) | Yes |
| Passkey support | Yes | Varies by tool |
| End-to-end encryption | Optional (passphrase) | Yes (by default) |
Cross-device availability and the passphrase option
A credential saved on desktop Chrome is available for autofill in Chrome on Android within seconds, and a new account created on the phone syncs the credential to the desktop before the next login from that machine. This cross-device availability eliminates the most frequent friction point in credential management — being on a different device than the one where the password was originally created.
The passphrase option provides stronger privacy protection. By default, Google encrypts synced credentials on its servers but holds the encryption keys. Setting a sync passphrase changes this: credentials are encrypted with your passphrase before leaving the device, and Google’s servers receive only ciphertext they can’t decrypt.
To set a passphrase: Chrome Settings → You and Google → Sync and Google services → Encryption options → “Encrypt synced data with your own sync passphrase” → enter and confirm. The passphrase must be entered on each additional device before it can access the encrypted credentials.
The critical limitation: if the passphrase is forgotten, recovery through the Google account isn’t possible. The only resolution is resetting sync entirely, which deletes all synced data and requires starting fresh. Store the passphrase somewhere secure outside Chrome — a physical notebook, a separately encrypted file, or a dedicated secrets manager. The security improvement is genuine; the recovery complexity is the honest trade-off that makes enabling it a deliberate choice rather than a default setting.
On ChromeOS specifically, the Chrome password manager integration is deeper than on Windows or Mac — the credential store is accessible from ChromeOS system-level authentication flows, not only from within the browser. Authenticating to Android apps through Google Play, logging into a system service, and browser logins all draw from the same credential store. This unified experience makes it proportionally more valuable on ChromeOS than on other platforms.
Managing saved credentials — practical maintenance
The credential list in the password manager accumulates entries over time, including sites you no longer use, services that have shut down, and duplicate entries created by multiple login attempts. Periodic maintenance keeps the list useful and the Security Checkup results meaningful:
- Delete unused credentials: sites you haven’t visited in over a year and have no intention of returning to. Clearing them shortens the list and reduces the surface area for breach exposure on services that may no longer be active.
- Fix incorrect saved credentials: sometimes Chrome saves the wrong username or an outdated password. If autofill consistently fails on a specific site, check the saved entry — it may have a typo or stale value from a previous login attempt before a password change.
- Handle multiple entries for the same site: some sites accumulate multiple credential entries over time (different URL variations, different login forms). The credential list shows all entries for a domain — delete duplicates and keep only the current working credential.
When autofill doesn’t work — troubleshooting specifics
Autofill failing on a site it previously worked on usually has one of a few causes:
- The site changed its login URL: Chrome matches credentials by site URL. If the login page moved to a different subdomain or path, the stored credential’s URL may no longer match. Edit the credential and update the URL to the current login page.
- The site blocks autofill in the form: some sites use
autocomplete="off"in their HTML to prevent any autofill (often banking and financial sites). Chrome ignores this attribute for passwords but some implementations are more aggressive. Try right-clicking the password field and selecting “Autofill” from the context menu. - Chrome Flags experimental setting interfering: if you’ve changed any experimental autofill settings at chrome://flags, these can interfere. Reset flags to default to rule this out.
- Password autofill is disabled in Chrome settings: Settings → Autofill and passwords → Google Password Manager → Settings → “Offer to save passwords” toggle — if this is off, Chrome won’t autofill or save. This is occasionally disabled by IT management on corporate machines.
The passwords.google.com web interface
The full credential store is accessible at passwords.google.com in any browser — Chrome, Firefox, Safari, Edge. After authenticating with the Google account, you can view, edit, and delete stored credentials, run Security Checkup, and review which sites have passkeys registered. This web interface is the recovery path when Chrome isn’t available, when you’re on a shared computer and need to look up a specific credential, or when you want to audit the full credential list from a larger screen than a phone allows.
The web interface doesn’t support autofill (credentials shown here can be copied manually), but it does support all management operations — the same editing, deletion, and checkup features available in Chrome’s built-in interface. For users who occasionally access accounts from non-Chrome browsers: keeping the passwords.google.com URL bookmarked provides manual credential lookup without requiring a dedicated password manager extension in those other browsers.
The Chrome password manager’s core advantage over third-party alternatives isn’t features — dedicated tools generally have more. Its advantage is zero friction: no separate app to open, no master password to remember on top of everything else, no setup required, and autofill that works automatically on every site where credentials are stored. For the majority of individual users who are currently either reusing passwords or memorising a handful of weak ones: enabling the generator for every new account and running Security Checkup monthly is a meaningful security improvement that costs nothing and requires no behaviour change beyond accepting the save prompts Chrome already shows. See also How to Use 1Password for a related case.
