How to Fix a Compromised Password on Your iPhone

Most of us know we should use a unique password for every account. In practice, most of us don’t. And when you’re managing dozens of logins, that’s an easy habit to fall into.

The problem is that data breaches happen constantly. When a company you have an account with gets hacked, your password can end up in a database shared among cybercriminals. If you’ve reused that password elsewhere, the damage can spread fast.

The good news: your iPhone can catch this for you. Since iOS 15, Apple has included a built-in feature that monitors your saved passwords and flags any that have appeared in known data breaches — or that are simply too weak to be safe.

Here’s what to do if you get an alert.

What Does a “Compromised Password” Alert Mean?

When your iPhone tells you a password is compromised, it means that password has appeared in a publicly known data breach — somewhere online, a list of leaked credentials exists that includes it.

A weak password alert is different. That just means the password is easy to guess: too short, too common, or reused across multiple accounts.

Both are worth fixing, but a compromised password is the more urgent one. If hackers have your password and you’re using it on more than one site, any of those accounts could be at risk.

How to Fix a Compromised Password on Your iPhone

Step 1: Open Security Recommendations

Open the Passwords app and tap Security (iOS 17 and earlier has Passwords in Settings).

Any accounts with weak or compromised passwords will be listed here. Tap on an account to see more detail about the issue.

Fig 1. Checking Security recommendations in the Passwords app.

Step 2: Change the password

If available tap the Change Password… button. This will open the relevant app or site so you can update your login credentials. If this option does not appear, go to the site or app and change the password there.

Fig 2. Changing a reused password in the Passwords app.

When creating a new password, aim for something long and unique — at least 12 characters, using a mix of letters, numbers, and symbols. Avoid anything that could be easily guessed: your name, birthday, or a simple word with a number tacked on the end.

Step 3: Repeat for every flagged account

Work through the full list in Security Recommendations. It can feel tedious, but it’s worth doing properly. A compromised password on a low-priority account can still be a problem if you’ve used it somewhere more sensitive.

What If You’ve Been Using the Same Password Everywhere?

This is a very common situation. If one of your passwords has been leaked and you’ve reused it across multiple sites, you should update it everywhere — not just on the account your iPhone flagged.
A few things worth prioritizing:

• Email accounts — access to your email means access to almost everything else
• Banking and financial apps
• Shopping accounts with saved payment details
• Your Apple ID

It’s also worth enabling two-factor authentication (2FA) on any account that supports it. Even if someone has your password, they won’t be able to log in without the second verification step.

Keeping Track of Your Passwords

If managing multiple unique passwords feels unmanageable, Apple’s built-in password manager is a solid option. It generates strong passwords, stores them securely, and syncs them across your Apple devices.

There are also third-party options available if you use multiple platforms or prefer a dedicated app — a quick search for “password manager” in the App Store will give you several well-regarded choices.

Wrapping Up

A compromised password alert isn’t something to ignore, but it’s not a reason to panic either. It means Apple’s security system is doing its job. The key is to act on it promptly: change the flagged password, update it anywhere else you’ve used it, and enable two-factor authentication where you can.

These small steps make a real difference. Most account takeovers happen because credentials from one breach get tried on other sites — and a unique password breaks that chain entirely.

If you’re also concerned about the security of your iPhone itself, you can run a free scan with Certo Mobile Security to check your device settings for any vulnerabilities.

Frequently Asked Questions

How does my iPhone know if my password has been compromised?

Apple uses a privacy-preserving technique to compare your saved passwords against databases of known leaked credentials. It does this without ever sending your actual passwords to Apple’s servers.

Is it safe to store passwords on my iPhone?

Yes. Passwords stored in the Passwords app are end-to-end encrypted, meaning only you can access them. Even Apple cannot read them.

What if I see an account I don’t recognize in Security Recommendations?

If you don’t remember creating an account, it’s worth investigating before simply deleting it. In some cases, it could indicate someone has used your email address to sign up for something. If the account is genuinely unused and unrecognized, you can remove it from your iPhone by going to Passwords, swiping left on the entry, and tapping Delete.