iOS 27’s Passwords app can fix your weak passwords by itself

Apple is adding a feature to the Passwords app in iOS 27 that goes further than flagging security problems: it can now fix them. With a single tap, Passwords will navigate to the relevant website on your behalf, sign in, and upgrade your account to a stronger password — without you opening a browser.

The existing version of Passwords already scans saved logins and marks those that are weak, reused, or have appeared in known data breach lists. The feature works, but it stops at the warning. Acting on it means clicking through to each website individually, finding the account settings page, locating the password change option, generating a replacement, and saving it — a process most people defer indefinitely, no matter how many warning badges accumulate in the app. Apple’s solution in iOS 27 is to collapse that process into a single confirmation tap.

Tap the suggested fix, and Passwords — working through Apple Intelligence and Safari together — handles the rest. It opens the website, signs in with your existing credentials, navigates to the password update flow, and replaces the weak password with a strong one Apple generates. The company uses the word “agentic” to describe this: software taking action on external websites on your behalf rather than just surfacing information for you to act on manually.

Other password managers — 1Password, Bitwarden, Dashlane — can autofill credentials when you navigate to a site yourself. None of them routinely navigate sites and make changes without you. This is Apple pushing Passwords into genuinely new territory: not just a credential vault, but an app that can act across the web on your behalf.

The privacy framing Apple put on this feature is worth noting. The autonomous browsing runs through Apple’s infrastructure, and the company says none of your account credentials or browsing activity during the fix process is shared with Apple or any third party. The process uses Safari’s existing on-device capabilities, rather than routing account actions through an external service that logs them.

There are limits. The automatic fix works where websites implement the standard protocols that let password managers detect and navigate the password-update flow. Well-maintained services with proper Safari integration should work. Older portals, smaller forums, or sites with non-standard account flows may still need manual handling.

The Passwords app has expanded steadily since it launched as a standalone app in iOS 18 — that release brought verification code integration and tighter breach database alerts. Autonomous password fixing is the most significant capability jump yet, and the clearest signal that Apple sees the app as something more than a built-in alternative to third-party managers.

iOS 27 and macOS 27 opened for developer testing on June 8 following the WWDC26 keynote. The automatic password fix feature is part of the broader Apple Intelligence update and will ship to general users this fall.

via Apple Newsroom