Apple’s Passwords App May Finally Fix the Hard Part: Changing Bad Passwords

Most people already know the advice: unique passwords, a manager, rotate anything leaked. The bottleneck is not knowledge — it is the grind. Spotting weak or breached logins is easy. Visiting dozens of sites, surviving two-factor prompts, and saving new secrets is not. That is why vaults fill up with “fix later” warnings.

At WWDC 2026, Apple previewed an Apple Intelligence feature for the Passwords app in iOS 27 (and related OS updates): an agent that lists problem accounts and can update weak or compromised passwords largely on its own. As Alex Blake writes for Macworld, that targets the real failure mode of password hygiene — friction.

What Apple announced

Like other managers, Apple’s Passwords app already flags weak or compromised saved credentials. Until now, fixing them meant doing the work yourself — open each site, change the password, confirm with MFA, save the new value.

The new agent is designed to take that list and act: go to eligible sites, walk the change-password flow, and write the new secret back into Passwords. Blake notes you may not even need to babysit the app while it runs.

That is a meaningful shift. Detection without remediation is half a product. Automated remediation — if it is reliable and scoped safely — is how average users actually close the backlog.

Why friction is the real security bug

Security advice that depends on heroic discipline fails at scale. People with hundreds of logins will not spend a weekend rotating credentials after every breach notification. They postpone, reuse, or ignore the alert.

Passkeys reduce shared secrets for new logins. Automated rotation attacks the pile of old passwords people never get around to fixing. If the agent works on enough “eligible” sites, average account security can rise without turning users into full-time IT.

That is the same reason password managers won: they made the secure path the easy path. An agent that finishes the last mile — actually changing the password — is the logical next step.

Open questions before you trust it blindly

Blake’s caveats are the right ones, and they matter for anyone evaluating this feature when betas land.

• What counts as “weak”? Does Apple only fix easily guessed strings, or also reused passwords that are otherwise strong?
• How well does the agent navigate messy change-password UIs across the web?
• What happens when a site demands 2FA via authenticator app, SMS, or email — especially if the code is not already in Passwords?
• What is the trust and audit model when software can change the keys to your accounts on your behalf?
• Which accounts are “eligible,” and what fails closed when the agent cannot finish safely?

AI as operator is not AI as password generator

It is important not to confuse two different jobs. Using an agent to operate a website’s password-change form is not the same as asking a chatbot to invent a new password.

Generation should still use a cryptographically secure random source — a password manager’s generator, or a CSPRNG-based tool in the browser. Large language models predict plausible strings; they do not draw uniform cryptographic entropy.

• We covered why chatbots are the wrong tool for inventing secrets in Why You Shouldn’t Use AI to Generate Passwords.
• When you rotate manually, create a long random secret with our password generator and store it in your manager — do not reuse or invent one.

What to do until iOS 27 ships widely

You do not need to wait for an AI agent to clean up the accounts that matter most. Start with anything that can unlock other accounts — especially email — then work outward.

• Use a password manager and a unique password for every account.
• Replace anything reused — see why even one repeat is dangerous in Password Reuse.
• Check older passwords against known leaks with a breach test (or your manager’s built-in monitor).
• Prefer passkeys or strong MFA on email, banking, cloud, and work accounts.
• If you need a refresher on spotting leaked credentials, read How to Check If Your Password Has Been Leaked.

The bottom line

If Apple ships this securely and it works on enough real sites, the Passwords app stops being only a vault and becomes a maintenance tool. That will not retire third-party managers overnight, but it raises the bar: detecting problems was never enough; closing them has to be almost as easy as ignoring them.

Until then, treat the WWDC preview as a direction of travel — and keep rotating the high-value accounts yourself with strong, unique, randomly generated passwords.

Source

Alex Blake, Macworld — Apple finally got rid of my biggest password headache