Your iPhone can tell you when a password you saved has shown up in a known data breach, but most people never turn that feature on, and fewer still check what it actually found. Security researchers have tracked billions of credentials across breach dumps, and a large share of them are reused passwords that quietly unlock several accounts at once. If you have ever used the same login for a shopping site and your email, one leaked database can become a skeleton key.
This guide walks through how iOS password leak alerts work, how to see which of your logins were flagged, what to do in the next ten minutes, and how to set up a routine so this doesn't become a one-off panic. I'll use a realistic example of a person with 47 saved passwords across 12 services, because that is roughly what a typical iCloud Keychain looks like after a few years of signing up for things. I'll also be honest about where Apple's built-in tools stop and where you need to do more yourself.
Along the way you'll see where specialized tools fit in. Some people want a single dashboard that covers their phone, browser, and website accounts, and that is a legitimate need. The goal here is to get you a clear picture first, so you can judge what you actually require.
Key Takeaways
- iOS can flag saved passwords that appear in known breaches, but only if Password Breach Detection is enabled in Settings.
- A flagged password is not proof your account was hacked; it means that exact password was seen in a leaked dataset.
- Change every flagged password first, starting with email and banking, because email is the recovery key for everything else.
- Reused passwords are the real risk: one breach can cascade across unrelated services within hours.
- Enable two-factor authentication on accounts that support it, and prefer passkeys wherever a service offers them.
- Run a monthly audit, not a yearly one, because new breach datasets surface constantly.
What Is an iOS Password Leak Alert?
An iOS password leak alert is a warning from Apple's operating system that one of your saved passwords has appeared in a database of compromised credentials. The feature is called Password Breach Detection (Apple also uses the phrase "Detect Compromised Passwords"). It runs against the passwords stored in iCloud Keychain and, in some cases, passwords you enter into Safari or apps that use the system keychain.
The check works without Apple seeing your actual password. Your device hashes a small portion of the credential and compares it against a list of known breached hashes, using a privacy-preserving lookup method so the full password never leaves your phone in readable form. That design is worth knowing, because it explains why the alert can be trusted as a signal and why it cannot tell you the breach name or the date.
Three things a leak alert is not:
- It is not a hack notification. It means the password string exists in a leaked dataset, which could have come from a site you used years ago.
- It is not a complete scan. Only passwords stored in your keychain or entered through supported paths are checked.
- It is not a substitute for two-factor authentication. A breached password without 2FA is still a live door, but a strong second factor makes a leaked password far less useful.
How Do I Turn On and Check iOS Password Breach Alerts?
The feature has to be enabled, and on some devices it is on by default after an update while on others it is off. Check it once, then check the flagged list whenever you're prompted.
Steps to enable breach detection
- Open Settings on your iPhone or iPad.
- Tap Passwords and authenticate with Face ID, Touch ID, or your passcode.
- Tap Password Options (on some versions, Security Recommendations appears directly).
- Turn on Detect Compromised Passwords.
- Return to the main Passwords screen and tap Security Recommendations. This is where flagged items appear.
Reading the Security Recommendations screen
The list groups your problem passwords into categories. The ones that matter most are:
- Compromised Passwords: appear in known breach data. Act on these first.
- Reused Passwords: the same string is used on multiple sites. A breach of one site exposes the others.
- Weak Passwords: short or guessable, easy to crack even without a breach.
- Passwords with no two-factor authentication: sometimes shown, depending on the service and iOS version.
Tap any entry to see the website or app it belongs to, the username, and the option to change the password. Apple will often send you directly to the site's password change page, which is convenient, though some sites route you to a generic login screen first.
Worked Example: Triaging 47 Passwords Across 12 Services
Consider a freelance designer I'll call Priya. She has 47 saved passwords in iCloud Keychain covering 12 services she actually uses regularly: email (two accounts), banking, a payment app, cloud storage, a design tool, social media, a streaming service, an online store, a password-protected forum, a coworking booking site, and a tax filing portal.
When she opens Security Recommendations, the screen reports:
- 3 compromised passwords
- 9 reused passwords (spread across 4 distinct strings)
- 5 weak passwords
- 6 services with no visible two-factor option flagged
Here is how she should triage it, in order:
| Priority | Account type | Why it comes first | Action |
|---|---|---|---|
| 1 | Primary email | Email resets every other account | Change password, enable 2FA, review forwarding rules |
| 2 | Banking and payments | Direct financial loss risk | Change password, enable app-based 2FA, check transaction history |
| 3 | Tax portal and cloud storage | Contains sensitive identity documents | Change password, enable 2FA |
| 4 | Shopping and streaming | Stored cards, but lower stakes | Change password, remove saved cards if unused |
| 5 | Forums, booking, social | Lower value, but reused strings spread risk here | Generate unique passwords, enable 2FA where offered |
Priya changes the three compromised passwords first. She discovers one of them is the password she used for a forum she joined in 2014, which is also the password for her secondary email. That secondary email was the recovery address for two other accounts. This is the cascade problem in practice: an old, forgotten site becomes a route into something important. The reused-password count dropped from 9 to 0 over the following two evenings, not because she memorized anything new, but because her password manager generated a fresh unique string for each account.
A realistic time budget: changing 12 passwords with 2FA setup takes roughly 60 to 90 minutes if you go one at a time, and the first sitting is the hard one. Plan for a single session rather than spreading it across weeks, because the longer a breached password stays live, the longer it's exploitable.
What Should I Do Right After I Get a Compromised Password Alert?
Follow a fixed sequence so you don't leave a gap. The order matters more than speed.
- Secure your email first. Change the email password, then go to the account's security settings and confirm recovery phone and recovery email are yours. Check for forwarding rules or filters you didn't create, since attackers often add these to hide password reset emails.
- Turn on two-factor authentication. Prefer an authenticator app or a passkey over SMS where you have the choice. SMS is better than nothing but is vulnerable to SIM swapping.
- Sign out of other sessions. Most major services have an "active sessions" or "devices" page. Revoke anything you don't recognize after changing the password.
- Change the affected password on every other site where it was used. Do not assume a password is only in one place. Search your keychain for the username or the string pattern.
- Check for financial or data activity. Review recent logins, transactions, and connected apps for the last 30 days.
- Replace reused and weak entries with generated passwords. A password manager with a generator is the practical tool here, not a memorized phrase.
If you find evidence of actual unauthorized access, such as transactions you didn't make or changed recovery details you can't reverse, contact the service's support and your bank directly. Keep screenshots and timestamps. For a fuller incident checklist, our guide on password manager breach response covers what to do when the exposure is larger than a single account.
Apple's Built-In Tools vs. Dedicated Password Managers
iCloud Keychain is good enough for many people, and it's free and tightly integrated with iOS. But it has gaps that matter if you use Android devices, Windows PCs, or multiple browsers, or if you want breach monitoring for accounts that aren't saved in your keychain. Here's how the common options compare on the criteria that actually change outcomes.
| Criteria | iCloud Keychain (iOS) | Dedicated password manager (e.g., Bitwarden, 1Password) | Standalone breach-check sites | Browser built-in manager |
|---|---|---|---|---|
| Breach detection | Yes, for saved passwords | Yes, usually across the vault | Checks an email or password, no vault | Varies, often limited |
| Cross-platform (iOS, Android, Windows) | Limited outside Apple devices | Strong across all platforms | Works anywhere in a browser | Tied to one browser |
| Password generator | Yes | Yes, configurable | Not applicable | Usually yes |
| Shared vaults (family or team) | Limited | Yes, in most paid plans | Not applicable | Limited |
| Cost | Free with iCloud | Free tier plus paid tiers | Usually free | Free |
| Audit depth | Reused
Cover image: Innovate Maryland Emerging Technology Center by MDGovpics, licensed under BY 2.0 via Openverse. |
