Custom Password Permissions in iOS 18 Explained

With the launch of iOS 18, Apple introduced a dedicated Passwords app that builds upon the shared password group functionality first seen in iOS 17. However, iOS 18 does not support custom or granular permission levels for shared password groups. Every person invited to a shared group has equal read and write permissions for the credentials stored inside it, meaning individual privileges—such as view-only access—cannot be assigned to specific members.

How Shared Password Groups Work in iOS 18

Shared password groups in iOS 18 allow family members, coworkers, or trusted contacts to share logins, passkeys, and verification codes securely via end-to-end encryption.

When a group is created:

  • Any credential moved into the group becomes accessible to every member.
  • All members can view, edit, update, and delete passwords placed in that group.
  • Changes made by one member automatically sync across the devices of all other group members via iCloud Keychain.

Because there is no "read-only" role, any participant who can view a password also has the technical ability to modify or permanently delete it from the shared vault.

Group Creator vs. Group Member Roles

While credential permissions are uniform across all members, Apple maintains a basic administrative distinction between the group creator and regular members:

  • The Group Creator: Holds the administrative authority to add or remove members, rename the group, and permanently delete the group.
  • Group Members: Can add, edit, or remove shared credentials, but cannot manage member invitations or delete the group itself. Any member can choose to leave the group at any time.

If a member accidentally deletes a shared password, it moves to the "Recently Deleted" folder within the Passwords app, where it can be recovered by the creator or other members for up to 30 days.

Best Practices for Sharing Passwords in iOS 18

Due to the absence of custom permission levels, managing sensitive access requires strategic organization:

  • Share Only with Trusted Individuals: Only invite contacts who require full modification privileges over the shared accounts.
  • Create Multiple Focused Groups: Instead of creating one large group with multiple contacts, set up separate groups for specific purposes (such as "Family Streaming," "Home Utilities," or "Work Projects") to limit unnecessary access.
  • Use Third-Party Managers for Granular Control: If your workflow requires role-based access control, such as view-only permissions or hidden passwords, enterprise-grade third-party password managers remain the necessary alternative.