Are Browser Password Managers Safe? The Real Risks (2026)

Browser password managers are safe enough for most accounts, and much safer than reusing passwords. Chrome, Safari, Firefox and Edge all encrypt what they store and only autofill on the exact domain, which also stops most phishing pages. Their real weakness is local: the vault opens with your operating system login, so malware running as you can usually read it. For your primary email, bank and admin accounts, that's the risk worth planning around.

I use both kinds myself: the browser's built-in manager and Psono, a dedicated manager you can self-host. The split below is how I'd decide what goes where.

Who holds the key

"Encrypted" means little until you know who can decrypt. The three big browsers differ more than their marketing suggests.

Google's own help page is explicit: with standard encryption, Google holds the key and decrypts your passwords when you view them or run Password Checkup. On-device encryption, an opt-in setting in Google Password Manager, moves the key to your devices. Once it's on, it can't be turned off, and if you lose both your Google password and the screen lock of every signed-in device, the passwords are gone. That's the same trade-off every end-to-end system makes.

Apple's iCloud Keychain has been end-to-end encrypted by default for years, which also means Apple can't recover it for you.

If you used Microsoft Authenticator to store passwords, that option is gone. Microsoft stopped saving new passwords in it in June 2025, turned off its autofill in July and removed access to saved passwords in August. Passwords synced to your Microsoft account now live in Edge's password manager, which puts them in the same "opens with your OS login" category as the browsers above. Passkeys stay in Authenticator.

Firefox is the one I'd fix first if you use it. Without a Primary Password, Mozilla's documentation says anyone with access to your computer can view saved passwords, and copying two profile files (logins.json and key4.db) is enough to read them elsewhere. Setting a Primary Password encrypts that key and gives Firefox the separate password prompt a dedicated manager has.

Infostealers are the real threat

The attack that actually empties browser vaults isn't a cryptographic one. It's commodity malware, sold as a subscription, that runs once on your machine and uploads every saved password, cookie and autofill entry it can find. RedLine, Lumma, Vidar and StealC are the common names.

This isn't limited to careless home users. Microsoft's 2022 write-up on the Lapsus$ group lists deploying the RedLine stealer, and buying passwords and session tokens on criminal forums, among the ways it got into large companies.

Google responded on Windows with App-Bound Encryption in Chrome 127 (2024), which ties the decryption key to a Chrome service running with system privileges, so a program running as you can't simply ask Windows to decrypt it. BleepingComputer reported in October 2024 that Lumma, Vidar, StealC, Meduza and Whitesnake had already shipped bypasses that work without admin rights. So it raised the attackers' cost for a few weeks, not for good.

Takedowns don't end it either. In May 2025, Microsoft's Digital Crimes Unit, the U.S. Department of Justice, Europol and Japan's JC3 seized or blocked about 2,300 domains behind Lumma, after Microsoft counted more than 394,000 infected Windows computers in the two months before. Trend Micro reported in July 2025 that Lumma's activity had climbed back to its usual level within weeks. Plan as if a stealer will always be on sale.

Two caveats keep this honest:

• A dedicated manager doesn't make you immune. While the vault is open, malware with your privileges can read its memory or log the master password as you type it. What a dedicated manager does add is a locked state: a vault at rest that can't be read without the master password, and an auto-lock timer.
• Stealers also take session cookies, and a valid session cookie skips both the password and 2FA. No password manager fixes that. Keeping malware off the machine does.

Your Google or Apple account is now the vault

Synced browser passwords are only as safe as the account they sync to. If someone takes over your Google account, they can sign in to Chrome on their own machine and, under standard encryption, see everything. That turns the account into a single point of failure for every saved password.

So protect that account first: passkeys or a hardware key rather than SMS, and up-to-date recovery options. The Passkey Checker tells you whether your browser and device support passkeys before you rely on them. SMS codes are the weakest option here because of SIM swaps and phishing kits that relay codes in real time.

Browser vs dedicated password manager

Dedicated managers carry their own risk: you're trusting a company with your encrypted vault. In the 2022 LastPass breach, attackers copied customer vault backups. The passwords inside were encrypted, but website URLs were not, and vaults protected by weak master passwords or old low iteration counts became offline cracking targets. A long random master password, ideally a 6–7 word passphrase, is what keeps a stolen vault from being cracked.

Generated passwords aren't the problem

Every browser now offers to generate a password, and they're fine. Chrome's default generator, per its source code, makes 15 characters from 56 letters and digits (it drops look-alikes such as l, I and O, and uses 2–9 for digits). That's about 15 × log₂(56) ≈ 87 bits, which no offline attack gets anywhere near. Adding symbols would add bits nobody needs.

If you want control over length and character sets, my Password Generator runs entirely in your browser, with every character drawn from crypto.getRandomValues(), and nothing it generates is sent anywhere. The math behind "how long is long enough" is in password entropy and minimum length.

Where I'd keep what

The rule behind the table is blast radius. Losing a forum account is annoying. Losing your primary inbox means losing every account that sends reset links there.

If you move passwords out of the browser, the export is a plaintext CSV. In Chrome it's under Google Password Manager settings, Export passwords. Import it into the new manager, then delete the file and empty the trash. Afterwards, run the important passwords through the Password Strength Checker and regenerate anything short or reused. If any of them showed up in a breach, follow the order in what to do after a data breach.

FAQ

Are browser password managers safe to use in 2026?

For most accounts, yes. They encrypt stored passwords, fill only on the matching domain, and make unique passwords effortless, which removes password reuse, the main cause of account takeovers. The trade-off is that the vault opens with your OS login, so malware on your computer can usually read it. Protect high-value accounts with passkeys or a hardware key, or keep them in a dedicated manager.

Can Chrome's password manager be hacked?

Its encryption hasn't been broken, but infostealer malware has extracted Chrome passwords from infected computers for years. On Windows, Chrome 127's App-Bound Encryption made that harder, and stealers including Lumma, Vidar and StealC had bypasses within weeks. A hijacked Google account is the other route, since sync makes the passwords available on any machine signed in to it.

Can Google see my saved passwords?

Under the default standard encryption, Google holds the key and can decrypt your passwords, for example to show them to you or to run Password Checkup. With on-device encryption turned on, the key stays on your devices and Google can't read them. The setting can't be undone, and losing your Google password plus every device screen lock means losing the saved passwords.

Should I trust browser-generated passwords?

Yes. Chrome generates 15 random characters from a 56-character pool by default, about 87 bits, and the other browsers are in the same range. If a site rejects a generated password for lacking a symbol, add one or regenerate with your own settings; the strength is already in the length.