Google has introduced a powerful new security feature to Chrome’s built-in Password Manager that automatically changes compromised passwords. This enhancement builds upon the Password Manager’s existing capabilities to generate strong passwords and identify credentials exposed in data breaches.

“When Chrome detects a compromised password during sign in, Google Password Manager prompts the user with an option to fix it automatically,” explained Google representatives Ashima Arora, Chirag Desai, and Eiji Kitamura. “On supported websites, Chrome can generate a strong replacement and update the password for the user automatically.”

The feature aims to reduce friction in the password-changing process, helping users maintain account security without navigating complex settings or abandoning the process midway.

## How Website Owners Can Support This Feature

Websites can implement this functionality by:
– Using `autocomplete=”current-password”` and `autocomplete=”new-password”` attributes to enable autofill and storage
– Setting up a redirect from `/.well-known/change-password` to their password change form

“It would be much easier if password managers could navigate the user directly to the change-password URL,” Kitamura noted. “By reserving a well-known URL path that redirects the user to the change password page, the website can easily redirect users to the right place to change their passwords.”

This development comes as the industry increasingly shifts toward passkeys as a stronger alternative to traditional passwords, with Microsoft recently making passkeys the default method for new customer account sign-ups.