Apple Passwords

Is Apple Passwords safe?

Yes, for anyone who uses only Apple devices. The Passwords app, which Apple split out of Settings in iOS 18, stores logins, passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, Wi-Fi passwords and two-step codes and syncs them through iCloud Keychain. That sync is end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary by default, unlike iCloud Backup, which needs Advanced Data Protection for the same protection. The weaker parts are outside the encryption: the app works only on Apple hardware, and no outside auditor has published a review of it. We score it 84/100, just below 1Password (86) and Proton Pass (89).

Is iCloud Keychain end-to-end encrypted?

Yes, and without any setting to change. Apple's iCloud data security overview, updated in January 2026, lists "Passwords and Keychain" among 15 categories that are end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary under Standard Data Protection. For those categories Apple says it does not have the keys and cannot help you recover the data. Apple's Platform Security guide says the design keeps passwords and passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary protected even if your Apple Account is compromised, iCloud is breached or an Apple employee goes looking.

It helps to check this feature by feature, because Apple's protection is not the same across iCloud:

Apple's Passwords privacy notice says sharing in groups "is end-to-end encrypted, and Apple cannot view the entries you share". Apple has not published a technical write-up of how group keys are exchanged.

What flaws have been found?

Three, all fixed. Researchers Tommy Mysk and Talal Haj Bakry of Mysk found that the Passwords app fetched some data over plain HTTP. Apple fixed both bugs in iOS 18.2, released on 11 December 2024, and credited them in January and March 2025. Apple describes the first (CVE-2024-44276) as letting someone on the same network "leak sensitive information" and the second (CVE-2024-54492) as letting an attacker in that position "alter network traffic". Neither exposed saved passwords, and we found no breach of iCloud Keychain.

The third was in the iCloud Passwords extension for Chrome and other browsers, not in Safari. Researcher Marek Tóth showed in August 2025 that a malicious web page could hide its autofill menu and trick a single click into filling a login or a verification code, even while the extension was locked. He reported it in April 2025, and Apple fixed it in extension version 3.1.30 on 21 October 2025.

What Apple does not have is the outside evidence 1Password and Bitwarden publish. The code is closed, and there is no public audit report of the Passwords app. Apple does run a large bug bounty, and its Platform Security guide is detailed, but that is the company describing itself.

What data does the Passwords app collect?

Very little, by Apple's label. "Other data" is linked to you for app functions, which is the sync itself, and product interaction data is collected for analytics without being linked to you. There is no tracking section. Apple's analytics on its own apps are a wider question covered by its device-level settings, but nothing on this label points to advertising.

Who should use something else

The Passwords app suits a person or family where everyone has an iPhone, iPad or Mac. It fits less well in these cases:

• Mixed households. There is no Android app, and Windows support depends on iCloud for Windows and a browser extension.
• Shared accounts that need roles. In a shared group, every member can edit or delete every item in it. Only the group owner can add or remove people.
• People who fear device theft. On an iPhone, the device passcode can unlock autofill. Use a long alphanumeric passcode and turn on Stolen Device Protection, so Face ID is needed away from familiar places.
• Work accounts. Admin controls, audit logs and recovery for staff are what business password managers are built for.

How to use Apple Passwords safely

1. Protect your Apple Account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or security keys, and set up a recovery contact or recovery key. Apple cannot reset end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary data for you.
2. Turn on Advanced Data Protection if you also want your iPhone backup out of Apple's reach.
3. Open the Security section of the app and change the passwords it flags as reused, weak or found in known leaks.
4. Use passkeys wherever a site offers them. Apple describes them as resistant to phishing, which is the main way passwords are still stolen.
5. If you move to another manager, use the app-to-app transfer added in iOS 26 rather than any plain text file.

How we scored it

Privacy (86) and security (85) are strong because Keychain sync is end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary without any setup, but security stops short of the leaders because there is no public audit and the app has had two network flaws. Transparency and control (76) is held back by the Apple-only design. Regulatory record (88) is high because no regulator has acted on the Passwords app; Apple's EU fines concern the App Store, and we score each Apple app on its own record.