Managing Chrome passwords means controlling how and where your login details are stored, accessed, and protected across devices. You can view, edit, delete, or export saved passwords through Chrome's built-in password manager, which syncs securely when enabled.
Chrome stores passwords locally on your device and optionally syncs them to your Google Account. This allows access across multiple devices while maintaining encryption. Passwords are encrypted using your Google account credentials and stored in a secure vault accessible only after authentication.
When you sign into Chrome with your Google Account, your saved passwords appear on all devices where you're signed in. This feature supports automatic filling during logins and alerts you if a password appears in a known data breach. The system uses Google's Safe Browsing infrastructure to detect compromised credentials.
Chrome's password manager runs automatically when you enter a username and password on a website. After a successful login, Chrome prompts you to save the credentials. If you choose "Yes," the site's URL, username, and password are stored in your local profile and synced to your Google Account if syncing is enabled.
Each saved password is encrypted using AES-256 encryption and stored in a SQLite database file located in your Chrome profile directory. On Windows, this path is typically C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Login Data. The encryption key is derived from your operating system's credential store or your Google Account password.
When you visit a site with saved credentials, Chrome auto-fills the form fields. You can manually trigger autofill by clicking the password field and selecting from the dropdown list. Chrome also checks for duplicates and warns you if a password is reused across sites.
There are four core actions available in Chrome's password settings:
To access these options, go to chrome://settings/passwords or go through via Chrome's menu: Settings > Autofill > Passwords. From there, you can see a list of all saved sites and their associated credentials.
| Action | Where to Find It | Security Implication |
|---|---|---|
| View passwords | Settings > Passwords > Show passwords | Requires device enable or Google Account sign-in |
| Edit password | Click pencil icon next to entry | Changes apply across all synced devices |
| Delete password | Click trash icon | Removes from local and synced data |
| Export passwords | Click "Export" button | Saves unencrypted CSV file to your device |
Exporting passwords creates a file containing site URLs, usernames, and plaintext passwords. This file is not encrypted and should be stored securely. The exported data includes all saved entries, including those from older devices or accounts.
Many users assume that saving passwords in Chrome is inherently safe because it's backed by Google. However, if your device is unlocked and someone gains physical access, they can view saved passwords without additional authentication. Chrome does not require a secondary factor to view passwords-even if two-factor authentication is set up on your Google Account.
A critical distinction: Chrome does not encrypt passwords at rest with a master password. Unlike standalone password managers such as Bitwarden or 1Password, Chrome relies on your OS-level lock (e.g., Windows Hello, macOS Touch ID) or Google Account sign-in to protect access. If your device is logged in and unlocked, anyone with access can view credentials.
For example, in 2022, researchers at the University of California, Berkeley, demonstrated that Chrome's password viewer could be accessed via a malicious extension with minimal permissions. The extension could read the password database and display credentials without user consent. This highlights the risk of installing extensions from untrusted sources.
Use a dedicated password manager for high-security accounts. Chrome's password manager is convenient but lacks advanced features like password generation, audit logs, and multi-device synchronization with end-to-end encryption.
Enable two-factor authentication on your Google Account. This adds a layer of protection even if someone gains access to your device or password database. Use a strong, unique master password for your Google Account and avoid reusing it elsewhere.
Managing Chrome passwords involves balancing convenience and security. While Chrome provides easy access and autofill, it doesn't offer full control over encryption keys or audit trails. For sensitive data, consider switching to a third-party password manager with stronger privacy guarantees.
Always verify that your device is locked when not in use. Avoid saving passwords on shared or public computers. Use the built-in password checkup tool at https://passwords.google.com to scan for compromised credentials.