Apple Passwords will change weak and compromised passwords automatically

Apple's Passwords app will be able to replace weak and compromised passwords on its own, the company announced June 8 at its Worldwide Developers Conference. The feature uses Apple Intelligence and Safari to sign in to a website on the user's behalf and change the password, after the user approves it with a tap.

Password managers have long been able to warn people that a password is reused, weak or has appeared in a breach. The hard part has been getting people to act on those warnings, because changing a password usually means visiting each site and working through its account settings by hand. Apple's approach automates that step.

How it works

According to Apple's announcement, Passwords navigates through websites to sign in and upgrade accounts to strong passwords. Apple describes the feature as acting "agentically," meaning the AI performs a multi-step task rather than only giving advice. BleepingComputer reported that it works on eligible accounts, but Apple has not published a list of which sites are supported.

Apple says its Apple Intelligence models run on the device and on its Private Cloud Compute servers, and that personal data processed in Private Cloud Compute is not stored or made accessible to Apple.

Availability

The feature ships with iOS 27, iPadOS 27, macOS 27 and Apple's other fall 2026 operating systems. Apple Intelligence requires recent hardware, including the iPhone 15 Pro or later. Apple says some features may not be available in all regions or languages; its announcement does not list Canadian availability for this feature specifically.

Why it matters

Credential stuffing, in which attackers try passwords leaked from one site against many others, depends on people reusing passwords. A tool that clears a backlog of flagged passwords in minutes could shrink that risk for a large number of users. It also gives an AI agent permission to sign in to accounts and change credentials, which raises questions about what happens if a site's page is altered or the process fails partway through. Apple has not detailed how it handles those cases.

The longer-term fix is passkeys, which Apple's Passwords app already supports and which have no password to steal. Automatic password changes are aimed at the many sites that do not yet offer them.

What to do

• Open the Passwords app now and review the Security section for reused, weak or compromised passwords.
• Switch to passkeys on any site that offers them.