Password Manager Cleanup: Fix Reused Passwords in 20 Minutes
Use the checkup built into Chrome, iPhone or Edge to find reused, weak and leaked passwords, then fix the important ones first in a timed 20-minute plan.
You probably already own a password checkup. Chrome, iPhone and Edge each scan saved logins for reuse, weakness and known leaks. Twenty minutes with the right order of operations beats a weekend of good intentions.
Minute 0 to 2: run the checkup
Pick the manager you actually use. If you use several, start with the one on the phone or browser you open most.
| Manager | How to find the checkup | What it flags |
|---|---|---|
| Google Password Manager (Chrome) | In Chrome on a computer: More > Passwords and autofill > Google Password Manager > Checkup. In another browser, go to passwords.google.com and run the checkup | Exposed, weak and reused passwords |
| Microsoft Edge | Settings and more > Settings > Passwords and autofill > Microsoft Password Manager > Password security check, or open edge://settings/autofill/passwords/checkup and select Scan now | Passwords found in a database of known leaks |
| iPhone, iPad, Mac (iCloud Keychain) | The Security Recommendations interface, reached through the password manager in Settings on iOS | Reused, weak and leaked passwords |
The Google steps come from Google’s page on changing compromised passwords, which defines the three categories as exposed (published online), weak (easy to guess) and reused (on more than one account). Microsoft’s Password Monitor page gives the Edge path and says matches appear on the Password security check page, and that only you can see which of your passwords are compromised. Apple’s security guide says reused means the same password is used for more than one saved password across domains, weak means it may be easily guessed, and leaked means it appeared in a data leak that Password Monitoring knows about. Apple’s page describes the interface but does not give a tap-by-tap path, and iOS menu names change between versions, so open your Passwords settings and look for Security.
Minute 2 to 8: fix the five that matter most
The checkup may list 200 entries. Do not start at the top of the list. Fix in this order:
- Your primary email. The FTC says to change passwords starting with your email, because password resets for other accounts are sent there.
- Your password manager’s own master login. Make this long and unique, and never reused.
- Banking, credit cards and payment apps.
- Phone carrier and cloud storage. A carrier account is a route to your number; see our number lock setup.
- Shopping accounts with stored cards, especially before sales.
For each, open the site yourself, go to the account’s password settings, and change it. Let the manager generate the new password. Google notes that Chrome can generate and save a strong password for your Google Account.
Minute 8 to 14: add a second lock where it’s offered
The FTC says multi-factor authentication adds “something in addition” to your password and “helps secure your account even if your password is exposed.” Turn it on for the same five accounts first. If a site offers a passkey, consider it; our passkey recovery plan explains how to set one up so that a lost phone doesn’t lock you out.
Minute 14 to 18: delete or dismiss the rest
- Dead accounts. If you won’t use a service again, delete the account if the site lets you, then delete the saved login.
- Old reused entries. Queue them for later; three a day is fine.
- Dismiss intentionally. Edge lets you dismiss a warning that no longer applies. Don’t dismiss a leak warning for an account you still use.
Minute 18 to 20: close the loop
- Write where the recovery methods live: backup codes, the recovery email and the phone number.
- Check that the manager works on your second device.
- Set a reminder for a 10-minute re-run in three months.
What the checkup cannot tell you
Google’s help pages do not spell out how the weak and reuse checks work, and a breach list can be incomplete, so a clean report is not a guarantee. The checkups also compare saved passwords: a password in your head, on a sticky note or in a spreadsheet won’t be scanned. Move those into the manager now, and delete the spreadsheet.
A note about the phishing that targets this exact task
Real warnings come from your manager or browser, inside the app. A pop-up on a website saying your passwords are leaked and you must install a tool or call a number is not that. If you see such a page, close it and run the checkup from the app yourself. If you have already entered a password on a page like that, our post on checking what actually happened after a click is the next step.
Shared logins and family accounts
Streaming, utilities and school portals are often shared by a household. Decide who owns each login, put it in a shared vault or tell the other person where it is, and avoid texting passwords. If you must share one with a relative, change it afterwards.
What else belongs in the manager
Beyond passwords, many managers can hold backup codes and recovery keys. Store them here only if the manager itself is protected with a strong unique password and a second factor, and keep an offline copy of the master recovery details somewhere safe. Writing the master password on paper in a locked drawer is a reasonable backup; a screenshot in your photo library is not.
If your manager flags dozens of reused passwords
Do not try to fix them in a day. Spend the 20 minutes on the five high-value accounts, then change two or three a day. Prioritize any account that has your card number, your address history or your tax details. By New Year’s Day the list will have shrunk without becoming a chore.
A realistic result
After one session you should have a safer email password, a unique password on the handful of accounts that hold money, a second factor on those same accounts, and a list of what is left. That is a good outcome. A clean zero is not the target; steady reduction is.