Chrome says your password was compromised? Here’s what to do

Chrome’s compromised-password warning deserves attention, but it is not by itself proof that someone has taken over your account. The useful next step is to verify the alert and replace the affected password.

1. Check the warning inside Password Manager

Open Chrome’s menu, choose Passwords and autofill → Google Password Manager → Checkup. Opening this yourself avoids relying on a link in an unexpected message. Google distinguishes exposed passwords from weak or reused ones; check which issue applies to each entry.

A compromised result means the username and password combination has been published online. See Google’s explanation of Password Checkup results.

2. Change the password on the affected account

Visit the service directly and use its account settings to create a strong, unique password. Update the saved entry in your password manager afterward. Editing only the saved copy does not change the password at the website.

Replace that password anywhere else you reused it. Dismissing a warning does not make an exposed password safe. Work through the list methodically rather than choosing small variations of the same password.

3. Look for signs of account access

For your Google Account, review recent security events and signed-in devices. Check recovery details and investigate unfamiliar changes. If you see activity you did not perform, follow Google’s compromised-account recovery instructions. They also explain what to do if you cannot sign in.

Enable two-step verification where available. If Gmail was accessed, review forwarding rules and filters as well: changing a password is only part of checking what an intruder may have changed.

4. Keep the cleanup manageable

Record which accounts you have reviewed, without writing their passwords in the checklist. For example: “Shopping account: password replaced, recovery email checked.” This makes a long list easier to finish without losing your place.

An old saved login may belong to an account you rarely use. Confirm its status through the real service before deciding it no longer needs attention. Removing a password-manager entry is not the same as closing that account.

If the warning arrived in a suspicious message

Do not send anyone a password or verification code to “confirm” the alert. Our suspicious-message checklist helps you assess unexpected requests. If you already entered information through a questionable link, follow what to do after clicking a suspicious link.

Once the affected accounts are secured, use our account security checkup to build a regular review habit.