Create and manage secure passwords on iOS Apfelpatient

Weak passwords are the most common entry point for hackers – with the built-in features of your iPhone, iPad and Mac you are better protected than you think.

A single compromised password can unlock access to emails, bank accounts, cloud storage, and social networks. Despite this, many people still use simple combinations like "123456" or the same password for multiple services. The good news is that Apple has created a system with the Passwords app, iCloud Keychain, and PassKeys that automatically generates, stores, and syncs secure passwords across devices. This article will show you step-by-step how to properly manage your passwords and secure your digital life.

What makes a password secure?

A secure password has three characteristics: it is long, unique, and random. Length is the most important factor – a 20-character password is exponentially harder to crack than an eight-character password, even if both contain special characters.

Specifically, this means: Use a unique password for each account with at least 16 characters that combines uppercase and lowercase letters, numbers, and special characters. Avoid personal information such as birthdates, names, or dictionary words. A password like "Summer2024!" may look complex, but it's easy for automated attack tools to guess.

The best solution: Let your iPhone create the password for you. Apple automatically generates strong, random passwords that meet all these criteria – and you don't even have to remember them.

The Passwords app: Apple's password manager

Since iOS 18, Apple has transformed the iCloud Keychain into a standalone passwords app. It comes pre-installed on every iPhone with iOS 18 or later and manages all login information in one central location. The app is protected by Face ID, Touch ID, or your device passcode and syncs all entries across your Apple devices via the iCloud Keychain.

The Passwords app is divided into several sections: Under "All," you'll find all saved logins. The "Passkeys" section displays the more modern, passwordless login method. Two-factor authentication codes are managed under "Codes." The "Wi-Fi" section lists all saved network passwords—a feature we describe in detail in our article Viewing Wi-Fi Passwords on iPhone. The "Security" section is particularly important, as it actively warns you about potential risks.

Use automatic password generation

When you create a new account on a website or in an app, your iPhone automatically suggests a strong password. Here's how to use this feature:

Tap the password field during registration. Your iPhone will display a suggested password above the keyboard. Tap "Use Strong Password" to accept it. The password will be automatically saved in the Passwords app.

If you want to replace an existing weak password with a secure one, open the Passwords app, find the relevant login, and tap "Edit." Then select "Change password"—the app will redirect you to the corresponding website where you can set the new password.

Set up AutoFill

To have your iPhone automatically fill in saved passwords in apps and websites, AutoFill must be enabled. Open "Settings," go to "General," and then to "Autofill & Passwords." There, enable "Autofill Passwords and Passkeys" and make sure that "Passwords" is selected as the source under "Fill From.".

Take safety warnings seriously

The password app continuously checks your saved passwords for three weaknesses: It detects passwords you use for multiple accounts. It flags passwords that are too short or easy to guess. And it compares your login credentials with known data breaches – if one of your passwords has been exposed in a security incident involving a service provider, you'll be warned immediately.

To review the security recommendations, open the Passwords app and tap "Security." There you'll see a list of all affected accounts with specific recommendations for action. Take these warnings seriously and change any compromised passwords immediately. If you suspect you've been the victim of a phishing attack, you should change all affected passwords without delay.

Passkeys: Log in without a password

Passkeys are the future of login. They replace the traditional password with a cryptographic key pair stored on your device. When logging in, you simply authenticate with Face ID or Touch ID – no password is entered or transmitted.

The key advantage: Passkeys can't be stolen because they never leave the device. They're immune to phishing because there's no password to enter on a fake website. And they're automatically synced across all your Apple devices via iCloud Keychain.

More and more services support passkeys – including Google, Microsoft, Amazon, and Facebook, which has offered passkeys on iPhone and iPad since 2025. To set up a passkey, go to the security settings of the respective service and follow the instructions. On Apple devices, passkeys are automatically saved in the Passwords app.

Set up two-factor authentication

Even the strongest password offers no complete protection if it is compromised in a data breach. Two-factor authentication (2FA) adds a second layer of security: in addition to the password, an extra code is required, which changes every 30 seconds.

The Passwords app can manage these codes directly – you don't need a separate authenticator app. Open the Passwords app, select the relevant login, and tap "Set up verification code" under "Security." Then scan the QR code displayed by the service. From now on, the Passwords app will automatically generate the corresponding codes and fill them in automatically when you log in.

Two-factor authentication is particularly important for your Apple account. It's required for most features since iOS 15 and protects access to iCloud, the App Store, and all linked services. We explain how to change your Apple account password in a separate article.

Share passwords securely

There are situations where you need to share passwords with others – for example, a family Netflix account or access to a shared Wi-Fi network. The Passwords app offers a secure solution for this: shared groups.

In the Passwords app, create a new group under "Shared Groups" and invite trusted contacts. All members can add selected passwords to the group, and changes will be automatically synced. This way, you can share login credentials without having to send them via messenger or email—which would pose a significant security risk. You can find all the details in our article Sharing Passwords Securely: iCloud Groups on iPhone.

Alternatively, individual passwords can be sent directly to other Apple devices via AirDrop. This works quickly and is protected by AirDrop's end-to-end encryption.

Secure your Apple Account: Prepare for recovery

Your Apple account is the key to your entire digital Apple experience. Forgetting your password and losing access can have serious consequences. That's why it's important to set up a recovery contact in advance—a trusted person who can help you regain access to your account in an emergency.

To do this, open Settings, tap your name, and then tap "Sign-in & Security." Under "Account Recovery," you can select a person. This person must also have an Apple device with the latest software version and have two-factor authentication enabled. You can find a detailed guide on how to do this in our article Protecting your Apple account – Setting up a recovery contact.

If you ever forget your password, our article Forgot your Apple Account password? will show you all the ways to regain access.

Avoid common mistakes

Even with the best tools, there are typical pitfalls when it comes to password security. A password you've come up with yourself is almost always weaker than an automatically generated one – even if it seems complex to you. Avoid writing passwords down in your iPhone's notes, in text files, or on scraps of paper next to your computer. The Passwords app is designed for this purpose and offers significantly better protection.

Never share passwords over the phone, via email, or through messaging apps—not even with people claiming to be Apple employees. Apple will never ask for your password. If you suspect someone knows your password, change it immediately. And always enable two-factor authentication for important accounts so that a stolen password alone isn't enough to gain access.

Password Manager Comparison: Apple, 1Password and Bitwarden

Password security starts with you

The tools for secure passwords are already pre-installed on your iPhone—you just need to use them. The Passwords app automatically creates strong passwords, warns you about security risks, and securely syncs everything via iCloud Keychain. Passkeys make the future even easier by eliminating the need for passwords. And with two-factor authentication, you can further protect your most important accounts.

Take a few minutes today to open your passwords app and review the security recommendations. Every weak password you change is a step closer to digital security. The best products for you: Our Amazon storefront offers a wide selection of accessories, including those for HomeKit. (Image: Shutterstock / Summit Art Creations)

Frequently Asked Questions: Creating & Managing Secure Passwords

How long should a secure password be?

A secure password should be at least 16 characters long and contain a random combination of uppercase and lowercase letters, numbers, and special characters. The easiest way is to use your iPhone's automatic password generation – these passwords meet all security criteria and are saved directly in the Passwords app.

Do I need a separate password manager in addition to the Apple Passwords app?

For most Apple users, the Passwords app is perfectly adequate. It creates strong passwords, syncs via iCloud, warns you about security issues, and supports two-factor authentication and passkeys. A separate password manager can be useful if you work across multiple platforms or need additional features like storing credit card information.

What are passkeys and how do they work?

Passkeys replace traditional passwords with a cryptographic key pair. The private key remains on your device, the public key on the service's server. You authenticate yourself via Face ID or Touch ID when logging in – no password is entered or transmitted. This makes passkeys immune to phishing and prevents them from being stolen.

How can I find out if my password has been compromised in a data breach?

The password app automatically checks your saved login credentials against known data breaches. Open the app and tap on the "Security" section. All affected accounts will be listed there, and you can change the respective passwords directly.

Can I import my passwords from another password manager?

Yes, but only on a Mac. Export your passwords from your previous password manager as a CSV file. Then open the Passwords app on your Mac, click "File," and then "Import Passwords." Select the CSV file and start the import. Delete the CSV file afterward, as it contains all the passwords in plain text.

Is the iCloud keychain secure enough?

The iCloud Keychain protects your data with end-to-end encryption – meaning only you can access your passwords, not even Apple. This requires a strong Apple account password and two-factor authentication enabled. For added protection, you can enable enhanced privacy settings for iCloud.

What do I do if I've forgotten my Apple account password?

You can reset your password directly on your iPhone: Open Settings, tap your name, then tap Login & Security, and then Change Password. If you don't have access to a trusted device, you can reset your password at iforgot.apple.com or use your recovery contact if you've set one up.