How iOS 18 Passwords App Detects Reused Credentials

In iOS 18, Apple introduced a dedicated Passwords app that centralizes credential management while actively monitoring your digital security. This article explains how the app scans your saved logins to identify duplicate passwords across different websites, how it protects your privacy during this process, and how you can resolve security warnings directly within the operating system.

On-Device Database Analysis

The Passwords app identifies reused credentials through local, on-device comparison. Whenever you save a username and password combination, the system indexes the entry within your local, encrypted keychain storage. The operating system continuously cross-references these entries against one another. If identical password strings are mapped to two or more distinct web domains or application identifiers, the app immediately flags the duplicate.

The Security Recommendations Dashboard

Flagged credentials are categorized inside the dedicated Security section of the Passwords app. When the app detects that an identical password has been used across multiple platforms, it applies a specific "Reused Password" badge to the affected accounts. The dashboard prioritizes these alerts based on severity, warning you that a breach on one service could compromise all other accounts sharing the same password.

Privacy and End-to-End Encryption

Apple performs all cross-credential matching locally on the device to maintain user privacy. Because the keychain is protected by end-to-end encryption, Apple cannot view your plaintext passwords, nor does the system send your password database to remote servers to check for duplicates. While the app does check against known public data breaches using cryptographic hashing techniques, the identification of duplicate credentials remains an isolated, local operation.

Resolving Reused Credentials

When you open a flagged entry within the Security dashboard, the Passwords app provides an automated workflow to fix the issue:

  1. Tap on the specific login entry labeled with a reuse warning.
  2. Select Change Password on Website, which launches the service’s direct password reset page in Safari.
  3. Use the system's built-in password generator to create a unique, strong replacement.
  4. Save the new password to update the entry in the app, which automatically clears the reuse warning for that account.