A saved-password warning usually means that the username-and-password combination matches credentials found in a known third-party breach. Treat the match as a prompt to replace the password immediately, wherever you reused it, then enable multifactor authentication (MFA). The warning alone does not prove that someone signed in to your account or that your password manager was breached.
You can verify the warning from the security checkup built into your password manager, browser, or phone. Open that tool directly rather than following a link in an unexpected email or text. The steps below cover Google Password Manager and Chrome, Microsoft Edge, Apple Passwords on iPhone, and an additional email-address check with Have I Been Pwned.
As an Amazon Associate I earn from qualifying purchases.
What an exposed-password warning actually means
Password checkups compare credentials you saved with information associated with known data breaches. Google describes Chrome’s process as comparing encrypted credentials with an encrypted list of known breached data. You receive a match when the password, or the password-and-account combination, corresponds to data that has appeared in a leak.
Recommended Free Tools
That result is serious because criminals can try leaked credentials on other services. It is not, by itself, evidence that an attacker logged in, read your data, or broke into the password manager that stored the credential. Microsoft explicitly says an Edge warning reflects a third-party leak and does not mean that the password stored in Edge was exposed.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
A service may show several kinds of findings at once:
- Compromised or exposed: the credential matches known leaked data. Replace it promptly.
- Reused: the same password appears on more than one account. One breach can therefore endanger several services.
- Weak: the password is easy to guess or lacks enough length and uniqueness. It may not have appeared in a breach, but it should still be replaced.
Labels and detection rules change as vendors update their databases. Read the finding as a risk signal, not as a timestamp or a forensic report about your specific account.
Check the password manager or browser directly
Google Password Manager and Chrome
- In Chrome, open the menu and choose Passwords and autofill.
- Select Google Password Manager.
- Choose Checkup to scan saved credentials for compromised, reused, or weak passwords.
- Open each flagged entry to see the associated service, then use that service’s official password-change page.
Google also documents automatic warnings for exposed passwords. If a warning arrived by email, notification, or text, do not use its embedded link as proof. Open Chrome or the Password Checkup page yourself and confirm that the same account appears there. A checkup can be run from another browser through Google’s Password Checkup web page when Chrome is not available.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMicrosoft Edge Password Monitor
- Open Edge Settings.
- Go to Passwords and autofill, then Microsoft Password Manager.
- Select Password security check.
- Review credentials that match known leaked credentials and choose the link that takes you to the relevant account so you can change its password.
An Edge match means the password is in the public domain following a third-party leak. It does not indicate that Microsoft’s or Edge’s own storage was breached. If Edge cannot open the account-change page, navigate to the service manually instead of searching through an unsolicited message.
Apple Passwords on iPhone
- Open the Passwords app and authenticate with Face ID, Touch ID, or your device passcode.
- Tap Security to see accounts Apple has flagged.
- Open an account, review the reason for the warning, and use the service’s password-change option.
- Check the app’s setting for Detect Compromised Passwords if warnings are not appearing.
Apple’s wording and screens can differ by iOS release. If you do not see the exact labels, look under the Passwords app’s security or compromised-password section. The important result is the account name and the reason it was flagged, not the exact menu wording.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
How the three checkups differ
| Platform | Where to start | Findings described in the documentation | Change-password handoff |
|---|---|---|---|
| Google Password Manager / Chrome | Passwords and autofill → Google Password Manager → Checkup | Compromised, reused, and weak saved passwords; automatic warnings are also supported. | Open the saved entry and go to the service’s official site. |
| Microsoft Edge | Settings → Passwords and autofill → Microsoft Password Manager → Password security check | Credentials matching known leaked credentials. | The result can move you to the relevant account. |
| Apple Passwords | Passwords app → Security | Accounts Apple identifies as having compromised passwords; Detect Compromised Passwords is available in settings. | Open the account and change the password through the service. |
The documentation does not establish one platform as universally better. When comparing checkups, consider whether scanning is automatic or on demand, whether weak and reused passwords are included, and how directly the warning leads to the service’s password-change flow.
Verify an alert without falling for a phishing link
An email or text can imitate a password warning. The safest verification method is to start from an app or bookmark you already trust:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Close the message and open your browser, phone settings, or password-manager app yourself.
- Run the built-in checkup and locate the account by name.
- Open the service’s address by typing it, using a known bookmark, or selecting the account’s established app—not a link supplied in the alert.
- Only enter your current password on the genuine service. Never disclose it to a person who calls or messages claiming to provide support.
Do not assume a message is genuine because it contains your name, a familiar logo, or an urgent deadline. A real checkup result remains visible when you open the manager directly; a message that cannot be confirmed there should be treated as suspicious.
Change the flagged password correctly
Changing only the copy saved in your browser does not secure the account. You must change the password on the service that owns the account, then update the saved entry.
- Open the service’s official account settings. Use its known app or manually entered website. Find the password, sign-in, or security section.
- Create a new, unique password. Do not recycle the exposed password, a minor variation, or a password used on another service. A password manager can generate and save a long random value.
- Save the new value only after the service accepts it. Confirm that autofill now offers the new password and remove the obsolete value from any duplicate entry.
- Sign out other sessions when the service offers that option. This can invalidate a stolen session or password, although the exact control differs by service.
- Check recovery details. Confirm that the recovery email address and phone number are yours and that no unfamiliar authenticator or security key was added.
- Record the change in your own security notes. A simple list of accounts changed helps prevent an overlooked reuse case.
Google, Microsoft, and the National Institute of Standards and Technology (NIST) all support replacing compromised credentials with unique passwords. A password change is the priority even when there is no sign that the account was accessed.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Find every account where the password was reused
Reuse is often the most urgent part of a warning. Attackers can take a password leaked by one site and try it against email, shopping, banking, social, or work accounts. Similar variants are also risky: changing only a final number, capitalization, or punctuation does not make a leaked base password safe.
- Look at the flagged password’s entry in your manager and note every service attached to it.
- Search the manager for distinctive parts of the old password or for entries marked reused.
- Think through accounts you created before adopting a manager, including old forums, retailers, school services, and apps.
- Change the password on each matching account, starting with your primary email, financial services, work accounts, and any account that can reset other passwords.
- Delete obsolete saved entries only after confirming that the new credential works.
If you cannot remember where a password was used, change the accounts you can identify and monitor the rest for sign-in alerts. Do not test an old password by repeatedly attempting to log in; failed attempts can trigger lockouts and do not reveal whether an account remains exposed.
Turn on multifactor authentication
NIST’s guidance says the first thing to do is add multifactor authentication. MFA can protect an account even when its password has been compromised because a sign-in also requires a second factor.
| Method | What it requires | Practical considerations |
|---|---|---|
| Authenticator app | A time-based code or approval generated on a trusted phone. | Works without cellular service for many implementations; protect the phone and recovery process. |
| Push notification | Approve a sign-in prompt in an app. | Convenient, but deny unexpected prompts and investigate repeated requests. |
| Text message code | A one-time code sent to your phone number. | More widely available, but dependent on the phone network and number security. |
| Hardware security key | A USB or wireless FIDO2-style key that you tap or insert. | Strong protection where the account supports it; keep a registered spare and store it safely. |
Methods differ in security, phishing resistance, convenience, and availability. Not every account supports a hardware key. Choose the strongest option the service supports, enroll backup methods, and store recovery codes somewhere separate from the device used to sign in. MFA does not make a reused password safe, so still replace the exposed password.
Look for signs that someone used the account
A password match is not proof of access. Investigate further when the service reports an unfamiliar sign-in, a new device, an unexpected password-reset message, altered recovery information, messages you did not send, or purchases you do not recognize.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
- Open the account’s official security page and review recent sessions, devices, and sign-in locations.
- Sign out sessions you do not recognize and change the password again from a trusted device.
- Restore your own recovery email, phone number, authenticator, or security key if any was changed.
- Check forwarding rules, filters, connected applications, and delegated access in email or productivity accounts.
- Use the service’s official account-recovery process if you are locked out. Do not pay an unsolicited “support” contact or share a verification code.
Microsoft notes that credential abuse can result in account lockout, theft of account data, or changed recovery options. Those are possible consequences that require investigation, not automatic conclusions about every flagged account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use an email-breach lookup as a separate check
Have I Been Pwned is a free service for checking whether an email address has appeared in a reported data breach. Entering an address there can reveal that an account identifier was included in a breach, but it is a different test from examining the saved passwords in Chrome, Edge, or Apple Passwords.
Use the two checks together:
- The password-manager check tells you which saved credentials need replacement.
- The email lookup can identify breached addresses, including addresses for accounts whose passwords are not saved on your current device.
An email result does not tell you that the current password is exposed, and an absence of a result does not prove that an account is safe. Breach databases can be incomplete, delayed, or limited to incidents that have been publicly reported.
Use a password manager to prevent the next reuse problem
NIST describes password managers as tools that generate unique passwords and store them so you do not have to memorize every one. The most useful features are a reliable generator, synchronization across the platforms you use, search and reuse detection, and MFA protection for the manager itself.
- Let the manager generate a different password for every account.
- Protect the manager’s vault with MFA when that option exists.
- Keep recovery information current and understand how account recovery works before you need it.
- Review the manager’s security or checkup view periodically rather than waiting for an email warning.
- Do not export or paste your entire vault into an untrusted website to perform a “scan.”
A manager reduces reuse, but it does not change passwords on your behalf unless you complete the service’s own change process. After changing a password, confirm that the new value is saved and that autofill no longer supplies the old one.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
What to do when the checkup finds many warnings
Work in a deliberate order instead of trying to change everything at once:
- Protect the control points: change your primary email password and enable MFA because email can reset other accounts.
- Secure high-impact accounts: handle banking, payment, work, health, government, and cloud-storage services next.
- Eliminate reuse: change every account that shared the exposed password or a close variant.
- Finish lower-risk accounts: update shopping, entertainment, forums, and dormant services, then close accounts you no longer need when closure is available.
- Document completion: mark each account only after its service accepted the new password and MFA status is confirmed.
If a service no longer exists, remove its saved credential and watch the email address that was associated with it. If an account contains valuable personal information, use the provider’s recovery or deletion process rather than leaving the exposed password active.
Troubleshooting common problems
The menu labels do not match
Browser and operating-system releases change labels and location. Search the settings for password security, checkup, compromised passwords, or Password Monitor. Use the vendor’s current help screen opened from the app or browser itself, not a result supplied in a suspicious message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The checkup reports no problems
A clean result means the tool found no match in the data it currently checks. It does not prove that every breach is known, that an unsaved password is safe, or that an account has not been accessed through another route. Continue using unique passwords and MFA.
You cannot change the password
Some services require a verified email, a current password, a one-time code, or a recovery process. Start with the service’s official account-recovery page. If the account is managed by an employer or school, contact that organization’s known support channel. Never give a recovery code to someone who contacted you unexpectedly.
The password was exposed years ago but the account is inactive
Change it if the account still exists, especially if the same password appears elsewhere. If the service allows permanent closure, delete the account after preserving anything you need. Removing a saved entry alone does not invalidate the credential on the provider’s system.
A calm, safe response
Handle a warning as a credential-replacement task, not as proof of an active takeover: verify it in the password manager, change the password at the service, remove every reuse, add MFA, and investigate unfamiliar account activity. Those steps address both possibilities—an exposed password that has not yet been used and an account that shows early signs of abuse—without trusting an unverified alert or handing credentials to a stranger.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
