What are Compromised Passwords?

Introduction

Since 2020, the Safari web browser on Apple devices can display when one of the saved passwords for websites or apps has been compromised. But what does that actually mean? And what measures are necessary when such a warning appears?

Here we explain what's behind the term and what to do when there are problems with your login credentials.

How Apple detects compromised passwords

Apple uses Privacy Preserving checks in iCloud Keychain. Hashes of your passwords are compared against known breach databases in a way that prevents Apple from learning your actual passwords. When a match is found, you see a Security Recommendation on macOS/iOS.

• Matches are based on known breach datasets (e.g., password/hash lists)
• Recommendations include reused/weak passwords and 2FA status
• Fixes can often be started directly from the Passwords screen
• Your cleartext passwords are not uploaded to Apple

Step‑by‑step: Fix a compromised account

1. Open Passwords (macOS: System Settings → Passwords; iOS: Settings → Passwords)
2. Tap Security Recommendations and select the affected site
3. Open the website and sign in
4. Change password to a strong, unique one (use the suggested generator)
5. Enable 2FA (authenticator app or hardware key preferred over SMS)
6. Update saved login in your password manager
7. Check reuse: If that old password was reused, change it everywhere else too

What Does "Compromised" Mean?

Passwords protect your data and access from hackers (Graphic: Midjourney).

A compromise can be equated with exposure, in terms of digitally available information, this means public disclosure. Compromised passwords are therefore security keys that have been exposed due to security vulnerabilities, hacking attacks, or other data breaches.

In addition to simply publishing stolen login data, cybercriminals can also offer them for sale. Regardless of the exact approach, stolen and possibly published credentials are referred to as compromised passwords.

What does it mean when a password is compromised? (Graphic: Midjourney)

How Do I Find Out if My Password Is in Someone Else's Hands?

On Apple devices, in addition to the Safari browser warning mentioned at the beginning, there are other ways to find out if saved passwords have been stolen and used by others. To do this, you open the password overview in settings. This works in current versions of macOS, iOS, iPadOS, and others in Settings or System Settings under "Passwords". There you click or tap on "Security Recommendations".

If passwords have been compromised, there will be a "High Priority Recommendations" section. It might say something like this about a compromised account:

"This password has appeared in a data leak, which puts this account at high risk of compromise."

Here you should log in as quickly as possible with the known login data and change the password. You should also keep an eye on passwords in apps and change them regularly if necessary.

Logins to different services should always have different passwords (Graphic: Midjourney).

Without Apple's Help: Finding Out if Email Addresses Were Found in Hacks

If you don't manage your passwords through iCloud or services like 1Password, you should be even more careful to change your passwords regularly. However, to specifically search for possible data theft, there are various services on the web where you enter your email address and then see whether and in which data leaks this address has appeared.

One of these services is available at haveibeenpwned.com. In addition to individual searches, there is also a notification service for future cases of finding the registered email address.

There are services where you can check if your email address has been compromised.

Best practices to prevent future compromise

• Use a password manager and never reuse passwords
• Prefer authenticator apps or hardware keys over SMS for 2FA
• Review email forwarding rules and recovery methods periodically
• Beware of phishing (check sender, domain, and links)
• Keep browsers and OS up to date for security patches

FAQ