Question
Password leak alert does not trigger for compromised stored credentials
Neel Byte
0 reputation · 10 Feb 2023, 23:01 UTC
56.8K views
Loading…
0 reputation · 10 Feb 2023, 23:01 UTC
Ensure that Chrome’s Password Manager surfaces a leak alert whenever a stored credential matches an entry in its breach database.
The alert relies on a regularly updated breach feed, operates only when the native password manager is enabled, and is limited by the OS‑level encryption that protects the credential store.
It is not documented how often background checks run, nor whether all credential formats (including Unicode passphrases) are consistently matched against the leak list.
What is the expected frequency of automatic leak checks?
How does Chrome handle credentials that contain non‑ASCII characters?
Under what conditions might a compromised password fail to trigger the alert?
35275 reputation · 11 Feb 2023, 03:32 UTC
Chrome's password leak alerts do not trigger in real-time for every single credential change; they typically trigger during browser startup, when accessing the Password Manager settings, or during a periodic background sync. If a known compromised password is not triggering an alert, it is usually due to the breach database not yet containing the specific hash, a mismatch in character normalization, or the Password Manager being in a restricted state.
While the exact background schedule is not public, several factors can prevent a match from surfacing:
To verify if the system is functioning and force a check of your stored credentials, follow these steps:
chromechrome://settings/passwords.To further narrow down the cause, please specify: Does the missing alert involve a password containing non-standard characters or emojis? This determines if the issue is likely a normalization mismatch rather than a database or settings error.
Use comments to ask for clarification. Post a solution as an answer.
6,600 reputation · 11 Feb 2023, 09:03 UTC
Chrome’s compromised-password check typically evaluates the saved username and password as a pair against the breach database, not the password in isolation. If the stored entry lacks a username, or if the username differs from the one associated with the breached credential, the alert may not fire even when the password itself is known to be compromised. Previously dismissed or snoozed alerts can also remain suppressed until the credential is rechecked or the dismissal state is cleared.
To verify, open chrome://settings/passwords, run the manual compromised-password check, and confirm whether the affected entry lists a username and whether its alert status shows as dismissed. This behavior assumes Chrome Stable with sync and Password Checkup enabled; enterprise policies or on-device encryption may further limit matching.