Apple Says the Passwords App Will Change Your Passwords for You

What Apple is actually promising

Apple's iOS page describes the feature in one line: the Passwords app alerts you to weak or compromised passwords and "can update them on your behalf without the hassle." 9to5Mac, which flagged the wording on 27 August, reads it as an agentic Apple Intelligence capability — a single tap sends the system to the relevant website, signs in with the credential it already holds, and writes a new one. The scope matters more than the phrasing. Apple is not describing a shortcut to a settings page. It is describing software that authenticates as you on a third-party service and rewrites the key to that account. Everything interesting about the feature, good and bad, follows from that sentence.

Twelve years of storing passwords, two years of judging them

Apple has been keeping credentials since iCloud Keychain arrived in iOS 7 in 2013, but for most of that time the system was a vault and nothing more. Judgment came later: iOS 14 added security recommendations that compare stored passwords against known breach corpora and flag reuse. The dedicated Passwords app only separated from Settings in iOS 18, two years ago, giving logins, verification codes, Wi-Fi keys and passkeys their own home. Each step moved Apple one notch further from storage and one notch closer to opinion. iOS 27 is the step where opinion becomes action. Until now the flag came with homework — you opened the site, found the account page, and did the work. The complaint about that design was never that users disagreed with the warning. It was that fixing twenty flagged logins is an afternoon nobody spends.

The plumbing that makes this possible at all

Automating a password change sounds like screen-scraping, and for years it was. What changed is a small, boring web standard: a well-known URL at `/.well-known/change-password` that a site can point at its own password-change page. It sits on top of RFC 8615, the convention that reserves that directory for machine-readable metadata, and Apple's WebKit team publicly backed it alongside Google and 1Password around 2021. That is the rail. A password manager that finds the well-known URL does not have to guess where the change form lives, or crawl a site's account menu hoping to recognise one. Sites that implemented it get a clean, predictable entry point. Sites that did not are back to guesswork, which is where automation historically breaks.

Google tried this, and it is instructive

Chrome shipped an "assisted password change" in 2021, built on the same Duplex automation Google had used for restaurant bookings. It worked on a short list of partner sites and never grew into a general capability. The lesson was not that the idea was wrong. It was that the long tail of the web — regional banks, forums, utility portals, anything with a bespoke account flow — does not behave, and an automation that fails halfway can leave a user locked out of their own account. Apple starts from a better position, because Safari's autofill machinery and iCloud Keychain already understand the sign-in forms of a very large number of sites. It faces the same wall: two-factor authentication. Any service that gates a password change behind an SMS code, an emailed link or a hardware key stops the automation cold, and those are exactly the services where a strong password matters most.

What you should check before iOS 27 arrives

Three things are worth doing now. Open Passwords, tap Security, and look at how long the flagged list actually is — the feature is only as useful as the backlog it clears. Confirm iCloud Keychain is syncing and that you have an account recovery method that does not depend on a password, because anything that can rewrite credentials can also rewrite one badly. And where a site offers a passkey, take it: a passkey has no password to rotate, which makes it the one login this feature will never need to touch.

The part Apple has not addressed

Software that signs in as you is software that can be persuaded to sign in somewhere else. Prompt injection on a hostile page is the obvious risk with any agent that reads a webpage and acts on it, and Apple has not published how the Passwords flow is isolated from page content. The Live Activity helps — a visible progress indicator is not a security control, but it does mean the process cannot run silently. Apple has not committed to a release either. 9to5Mac reports the feature is expected in iOS 27.0 but has appeared inconsistently across betas, which puts iOS 27.1 in play. iOS 27 itself is due to all users within weeks. For a capability that touches every account a person owns, arriving a point release late would not be the worst outcome. For context on why compromised credentials are worth this much engineering, see our earlier report on ClickLock, the macOS stealer that made Macs unusable to harvest passwords.

Sources

- iOS 27's Passwords app adds powerful feature that can save you time — 9to5Mac, 27 August 2026 - Apple — iOS - New Apple feature automatically changes your compromised passwords — BleepingComputer - New iOS 27 Passwords app can automatically change your passwords for you — TechRadar