How Safari Alerts You to Breached and Reused Passwords

This article explains how the Safari web browser protects your online accounts by actively monitoring your saved passwords for security vulnerabilities. It covers the specific visual alerts Safari generates when a password is found in a known data breach or is reused across multiple websites, how to locate and fix these issues in your settings, and the privacy-preserving technology Apple uses to check your credentials.

Visual Indicators and Security Recommendations

Safari uses a built-in feature called "Security Recommendations" to notify you of compromised or weak passwords saved in your iCloud Keychain. Instead of sending intrusive pop-ups while you browse, Safari flags issues directly within your password management settings and occasionally during the login process.

When a vulnerability is detected, Safari displays a small warning icon—an exclamation mark inside a triangle—next to the affected website entry in your saved passwords list. Clicking or tapping on the flagged account reveals a specific alert message detailing the exact issue.

Data Breach Alerts

If one of your passwords appears in a known data leak, Safari marks it as a high-priority risk. You will see a prominent warning message stating: "This password has appeared in a data leak, which puts this account at high risk of compromise. You should change your password immediately."

In newer versions of macOS and iOS, if you visit a website using a compromised password, Safari may also display a subtle inline warning beneath the login fields or immediately after you autofill the credentials, prompting you to update the password on the spot.

Reused Password Alerts

If you use the exact same password for more than one website, Safari flags all associated accounts with a lower-priority warning, though it still urges action. The alert states: "This password is used on other websites. Using the same password on multiple sites makes it easier for someone to access your accounts."

Directly beneath this warning, Safari lists all the other websites stored in your keychain that share this identical password, allowing you to see the full scope of the vulnerability.

How to Find and Fix Flagged Passwords

You can view all of your Safari password alerts in one centralized location on your Apple devices:

• On a Mac: Open Safari, click Safari in the top menu bar, select Settings (or Preferences), and click the Passwords tab. After authenticating with Touch ID or your system password, look at the Security Recommendations section at the top of the list.
• On an iPhone or iPad: Open the Settings app, scroll down and tap Passwords (or open the standalone Passwords app on iOS 18 and later), and tap Security Recommendations.

To help you resolve the alerts quickly, Safari provides a Change Password on Website button inside the alert details. Clicking this button opens the specific website's login or password-reset page directly in Safari. You can then use Safari’s built-in password generator to create a strong, unique replacement, which automatically updates your iCloud Keychain.

How Safari Checks Passwords Privately

To check for data breaches without exposing your private information, Safari uses a cryptographic method known as k-anonymity.

Instead of sending your actual passwords to a server, your device hashes your passwords and sends only a tiny prefix of that cryptographic hash to Apple. Apple returns a list of known breached password hashes that match that prefix. Your device then compares the full hashes locally. This ensures that your actual passwords never leave your device in plain text, and Apple never knows which passwords you use or if they have been compromised. Reused password checks are even simpler, occurring entirely offline and locally on your device by comparing the items stored in your keychain against one another.