How to Use the Apple Passwords App to Replace Your Old Password Manager

There is a particular email I stopped dreading about a year ago: the one telling me my password manager subscription was about to renew for another year. Instead of paying it, I spent a wet Sunday morning moving every login I owned into Apple’s Passwords app, and I have not missed the old one for a single day since. If you already live inside iPhones and Macs, there is a decent chance you have been paying a yearly fee for something Apple now hands you for free, and in a couple of ways does better.

The Passwords app arrived properly in 2024, and what it really did was take the old iCloud Keychain — which lurked invisibly inside Settings and autofilled your logins without you ever once looking it in the eye — and turn it into a real app with an icon you can open. That sounds cosmetic. It isn’t. The moment you can actually see your passwords, your passkeys, your two-factor codes and your saved Wi-Fi networks in one window, you stop treating them as things that happen to you and start treating them as things you manage.

I want to be careful through all of this, because passwords are the one corner of your digital life where bad advice costs real money and a genuinely bad week. So everything below is the actual way it works, including the sharp edges I’d want a friend to warn me about.

What actually lives in the app

Open Passwords and authenticate with Face ID, Touch ID, or your device passcode — it will not show you a thing until you prove who you are, which is exactly right. Inside, everything is end-to-end encrypted and synced through iCloud Keychain, so it travels with you across iPhone, iPad, Mac, and Apple Vision Pro automatically. There is even an official iCloud Passwords app and browser extension for Windows, which surprised me the first time I needed it on a work PC.

Related reading

Here is what it holds, and where each piece earns its keep.

That last row is the quiet hero. Tap Security and the app tells you which passwords you’ve reused, which are weak, and — using Apple’s monitoring against known data leaks — which ones have actually turned up in a breach. It is an uncomfortable list the first time. Mine had thirty-one reused passwords on it. Working through that list did more for my safety than the manager I’d been paying for ever had.

Turn AutoFill on, and turn the old one off

This is the step people forget, and then they wonder why nothing fills in. On iPhone and iPad go to Settings → General → AutoFill & Passwords, switch on AutoFill Passwords and Passkeys, and make sure Passwords is ticked as the source. On a Mac it lives in System Settings → General → AutoFill & Passwords.

The bit that matters: if you are leaving a third-party manager, untick it here. iOS will happily let two managers both offer to fill your logins, and the result is a confused little menu every time you sign in. One source, chosen on purpose, beats two sources fighting over your tap.

Moving in, the careful version

Importing is genuinely easy, but the file you create on the way is the most dangerous thing on your computer for about ninety seconds, so treat it that way. Almost every manager exports your entire vault as a plain-text CSV — every password, readable by anyone who opens the file. The job is to get it into Passwords and then destroy it.

Do the import on a Mac, where the tool lives. Open Passwords, then from the menu bar choose File → Import Passwords, pick your CSV, and let it map the columns. Once it’s done, spot-check a few logins, confirm AutoFill is working, and then delete the CSV and empty the Trash. Do not email it to yourself, do not leave it in Downloads, do not “keep it just in case.”

Related reading

Only when AutoFill is confirmed working and the CSV is gone should you cancel the old subscription. Order matters. Burn the bridge after you’ve crossed it, not before.

Passkeys and verification codes, which are the actual upgrade

Two features here are worth setting up deliberately, because they’re where Apple’s app quietly beats a plain password vault.

Passkeys replace a password entirely with a cryptographic key stored in your Keychain. You sign in with Face ID, there is nothing to type, and — this is the important part — a passkey cannot be phished, because it only works on the real site it was created for. When a service offers to “set up a passkey,” say yes. Your bank, your email, your Apple Account, and an increasing number of shops now support them, and every one you add is one fewer password a fake login page can ever trick out of you.

Verification codes are the other one. Those six-digit two-factor codes you currently get by text, or from a separate authenticator app, can live right here. Open a login, tap Set Up Verification Code, then either scan the QR code the site shows you or paste the setup key. From then on, the Passwords app generates the rotating code and fills it in automatically right after your password. One tap signs you in with both factors. It is the single feature that made me stop opening a second app fifty times a day.

Sharing a password without texting it

The thing I never expected to like this much is shared groups. Instead of messaging your partner the streaming password — which then sits forever in a chat anyone glancing at your phone can read — you create a group and share the login properly. Tap the + in the app, choose New Shared Group, name it, and add people from your Contacts who use Apple devices. Everyone in the group sees the shared logins, edits stay in sync, and when you change the password it updates for all of them. It is end-to-end encrypted, and you can remove someone and their access goes with them. For a household, this is the feature that ends the era of passwords scrawled on a kitchen note.

Spend the first week on the Security tab

The import is the boring part; the Security tab is where your safety actually improves, so don’t close the app the moment everything’s moved in. It hands you an ordered list of problems — passwords caught in known leaks, ones you’ve reused across different sites, and weak ones you set up years ago and forgot. Work it top-down, a few each day. Most entries have a Change Password on Website button that drops you straight onto the right page, and when you pick a new password the app quietly updates its own copy in place. Treat it as a fortnight-long chore list rather than one grim afternoon, and you come out the other side with every login unique and nothing of yours sitting in a breach.

Related reading

Where it’s honestly weaker than the paid apps

I’m not going to pretend it’s a clean win for everyone. A few real gaps:

It is an Apple-only world. There is no native Android app, so if your phone is a Pixel and your laptop is a Mac, a cross-platform manager still makes more sense. The app also stores logins, passkeys, Wi-Fi and codes — but not the secure notes, identity profiles, document attachments, or stored card details that a dedicated vault gives you (your cards live separately in Wallet and Safari AutoFill). And the organisation is deliberately thin: there are no folders or nested categories, just search and a flat list, which power users will find spartan.

For the vast majority of people reading an Apple blog, none of those gaps will ever bite. You sign in with Face ID, the codes fill themselves, the passkeys can’t be phished, and the breach list tells you exactly what to fix. The Passwords app is the rare case of Apple quietly making a whole category of paid software unnecessary for the people already inside its world — and the only reason most of us kept paying was that nobody told us the free thing had grown up. Consider yourself told. Move in this weekend, shred the CSV, and let that renewal email go unanswered.