iOS Internals · iCloud & Your Apple Account · Lesson 3 of 5

Passwords & Keychain

Let iCloud Keychain remember your passwords and warn you when one leaks.

Why memory loses

Most people have dozens of online accounts and only a few passwords in their head. So they reuse them, and that's the problem a password manager solves.

Here's why reuse is dangerous. Websites get hacked, and stolen lists of email addresses and passwords end up for sale. Criminals feed those pairs into the sign-in pages of banks, shops and email services, betting that people reused them. This is called credential stuffing. If the password from an old hobby forum matches your email password, a breach you never heard about can unlock your inbox. From there, a criminal can reset the password of every account that sends reset links to that inbox.

A password manager fixes this by remembering for you. Every account can have its own long, random password that you never have to type or recall. On iPhone the built-in one is iCloud Keychain. It stores your passwords, passkeys, Wi-Fi passwords and saved card details, and syncs them across your Apple devices. Apple says Keychain is end-to-end encrypted by default, so Apple can't read it.

Since iOS 18, you can see everything Keychain holds in the Passwords app. Before that, saved passwords lived inside the Settings app. The Passwords app brings together:

• account passwords and passkeys
• Wi-Fi passwords, which you can share without revealing them
• verification codes for two-factor sign-ins on other websites, so you don't need text messages or a separate authenticator app
• shared groups, for sharing chosen passwords with family or friends

Opening the app needs Face ID, Touch ID or your passcode. And if Stolen Device Protection is on and you're away from familiar places, using saved passwords needs Face ID or Touch ID, with no passcode fallback. That matters because some phone thieves watch people type their passcode before stealing the phone.

A memorized password has to be short enough to remember. A password manager's passwords can be long and random, and different everywhere, which takes credential stuffing off the table.

AutoFill and warnings

A password manager only helps if it's easy to use, and iPhone makes it easy with AutoFill. When you tap a sign-in box in Safari or a supported app, your iPhone offers the matching saved login above the keyboard. You approve with Face ID and it fills in the username and password. When you create a new account, iPhone can suggest a strong password, a long random one, and save it for you in one tap.

AutoFill has a quiet security bonus. It offers a saved login only for the website or app it was saved for. If a phishing link takes you to a lookalike site such as app1e-support.com, your iPhone won't offer your Apple Account login there, because the address doesn't match. When AutoFill suddenly offers nothing on a site you use all the time, stop and check the address before typing anything by hand.

The Passwords app also checks your saved passwords for you. In iOS 18 and later, open Passwords and tap Security to see warnings about:

• reused passwords, used on more than one site, which leave you open to credential stuffing
• weak passwords, which an attacker could guess easily
• compromised passwords, which have appeared in a known data leak

The leak check is called Password Monitoring, and its switch is named Detect Compromised Passwords. It's built so your passwords aren't sent to Apple. Your iPhone checks your passwords against a large list of passwords known to have leaked, using a scrambled form of each one, so Apple never learns your actual passwords.

When you see a warning, tap the item and follow the steps to change that password on the website, ideally to a new strong one. Fix compromised passwords first, then reused ones, starting with email and banking. If a site supports passkeys, switching to one means there's no password left to leak.