Is it safe to save passwords in your browser?

Chrome, Firefox, Safari and Edge have been offering to save your passwords for years. It is convenient and free, and the question is a fair one: is it enough? The short answer is that it is far better than reusing the same password everywhere, and worse than a dedicated manager. The long answer depends on what you are protecting against.

What it does well

• It encrypts passwords on disk, tied to your operating system or browser account.
• It warns you if a password appears in known breaches. Chrome and Firefox both include this check.
• It only autofills on the correct domain. This matters more than it sounds: if a phishing site imitates your bank, the browser fills in nothing because the domain does not match. You might fall for it; it will not.
• It removes the excuse to reuse. And reuse is by far the biggest real-world risk for an ordinary person.

Where it falls short

1. It is tied to your session

If someone has access to your unlocked computer, in many cases they can view the saved passwords with little or no additional friction. A dedicated manager locks itself after a period of inactivity and demands its own master password.

2. It is malware's favourite target

There is an entire family of malicious software — infostealers — built specifically to extract credentials saved in browsers. It is where they look first, precisely because it is where almost everyone keeps them.

3. It only works inside its own ecosystem

Chrome's passwords live in Chrome. If tomorrow you want to use Firefox, or you need your home Wi-Fi key which belongs to no website, or you want to share a credential with your partner, the browser will not help.

4. It stores passwords, not secrets

A dedicated manager also stores secure notes, recovery keys, two-factor backup codes, documents or card numbers. The browser handles username-and-password pairs and nothing else.

So what should I do?

It depends on your situation, and none of these answers is wrong:

• If you currently reuse the same password everywhere: start using the browser's manager today. The improvement is enormous and immediate, and it costs nothing. Do not let perfect get in the way of good.
• If your machine is shared or you hold sensitive accounts: a dedicated manager is worth it. Bitwarden, 1Password, Proton Pass and KeePass are well-established options, and several have free tiers.
• Either way: turn on two-factor authentication wherever you can. That is what stops a leaked password from being enough to get in.

Three things regardless

1. Protect the account that protects the others. If you sync passwords with your Google or Apple account, that account becomes the master key: give it a unique password and two-factor authentication.
2. Put a password or PIN on your operating system. Without one, the browser's encryption buys you very little.
3. Do not keep the critical ones there. Your main email and your bank password can be memorised: there are only two of them, and a passphrase makes that realistic.

And the passwords themselves

A manager is only as good as what you put inside it. Generate every password at random and check the ones you already use in the breach checker.