Optimize your website so that Google Password Manager can automate password
changes for compromised credentials.


![José Luis Zapata](https://web.dev/images/authors/zapata.jpg) José Luis Zapata [GitHub](https://github.com/zapata131) [LinkedIn](https://www.linkedin.com/in/zapata131) [Bluesky](https://bsky.app/profile/zapata131.bsky.social) [Homepage](https://www.zapata131.com) ![Ece Scheuss](https://web.dev/images/authors/eceirem.jpg) Ece Scheuss [LinkedIn](https://www.linkedin.com/in/ece-scheuss-78845a22)

<br />

> [!WARNING]
> **Preview:** This page provides information about an upcoming feature. We are expanding feature coverage through testing across selected websites to ensure compatibility and reliable behavior.

Automated Password Change helps users quickly update
passwords found in public data breaches for Chrome desktop users in the US. When
Google detects that a saved password was exposed, Google Password Manager can
create a strong, unique replacement and update it for your users.

The feature fills out the site's password change form for the user with a new,
strong password and saves it to Google Password Manager, all done in the
background. This removes the need for manual updates and helps users keep their
account secure.

## User experience

When a user signs in to a supported website using a compromised password, Google
Password Manager may offer to change it for them. If they accept, the Automated
Password Change process begins.

Automated password change navigates the website and completes the password
update for the user.

The user can cancel it while it's happening. After the process is done, the new
password is saved to their Google Password Manager and linked to their Google
Account, so it's available on all synced devices.

## How compromised passwords are identified

When a user saves a password or signs in to a site, Chrome checks whether the
username and password have appeared in a public data breach.

To do so, Chrome uses a privacy-preserving process to compare your encrypted
credentials against a list of known breaches. If a match is found, Chrome
notifies the user that the password is compromised. Google never sees actual
usernames or passwords. For more details, you can read about how Google helps
protect your accounts from data breaches on the [Google Security
Blog](https://security.googleblog.com/2019/02/protect-your-accounts-from-data.html).

Lists of compromised passwords are established by public data breaches and
security analysts.

## Optimization for Automated Password Change

To optimize your website for Automated Password Change and improve compatibility
with Google Password Manager and other tools, implement the following web
standards and best practices. These changes help browsers and password managers
interact reliably with password-related forms.

### Use a well-known change password URL

Use the path `/.well-known/change-password` to advertise the location of your
password change page. This URL helps browsers and password managers, such as
Google Password Manager, quickly direct users to the right place when a password
update is needed.

For example:

```html
https://yourdomain.com/.well-known/change-password
```

This improves the user experience and supports features like Automated Password
Change. Supporting this path increases the likelihood that your site will be
compatible with automated tools.

The URL `/.well-known/change-password` must redirect to your password change
form.

> [!NOTE]
> **Note:** Some password change pages require extra clicks to display the actual password change form. Displaying the form directly on the redirected URL, or using a URL fragment to reveal the password form, helps Automated Password Change work smoothly.

You can implement the redirect in one of two ways:

- **Server-side (recommended)** :
  - Configure your web server (such as Apache or Nginx) to issue a temporary redirect using HTTP status code 302, 303, or 307.
  - Avoid using 301 (permanent redirect) in case the destination changes.
  - If the user is not signed in, the redirect can take them to a sign-in flow first.
- **HTML meta refresh (alternative)**:

  - Serve a basic HTML page at the well-known path that performs a client-side redirect:

  ```html
  <!DOCTYPE html>
  <html>
  <head>
    <meta http-equiv="refresh" content="0;url=https://example.com/settings/password">
    <title>Redirecting...</title>
  </head>
  <body>
    <p>Redirecting you to the change password page...</p>
  </body>
  </html>
  ```
  - The `/.well-known/change-password` path must not host the actual password change form. It is meant only for discovery and redirection. See [A Well-Known URL for Changing
    Passwords](https://w3c.github.io/webappsec-change-password-url/) for more details.

See the [Help users change passwords easily by adding a well-known URL for
changing passwords](https://web.dev/articles/change-password-url) article to
learn more about the change password well-known URL.

### Use autocomplete attributes in forms

Browsers and password managers use the `autocomplete` attribute to understand
the purpose of form fields. This attribute helps improve autofill accuracy,
enables password generation, and is required for features like Automated
Password Change to work reliably.

Use these `autocomplete` values:

| Value | Purpose | Common usage |
|---|---|---|
| `username` | Identifies the account username | Sign-in, sign-up, password change |
| `current-password` | Field for the existing password | Sign-in, password change |
| `new-password` | Field for a new password | Sign-up, password change, reset |

> [!NOTE]
> **Note:** For password change pages, use `new-password` on both the new password and confirmation fields.

The following code snippet shows an example form with `autocomplete` values:

```html
...
<form action="/change-password-handler" method="post">
  <div>
    <label for="current-pw">Current password:</label>
    <input type="password" id="current-pw" name="current-password"
           autocomplete="current-password" required>
  </div>

  <div>
    <label for="new-pw">New password:</label>
    <input type="password" id="new-pw" name="new-password"
           autocomplete="new-password" required minlength="8"
           aria-describedby="password-constraints">
    <div id="password-constraints">Minimum 8 characters.</div>
  </div>

  <div>
    <label for="confirm-pw">Confirm new password:</label>
    <input type="password" id="confirm-pw" name="confirm-password"
           autocomplete="new-password" required minlength="8">
  </div>

  <button type="submit">Change password</button>
</form>
...
```

### Additional best practices

Follow [these guidelines](https://web.dev/articles/sign-in-form-best-practices)
to improve the usability and compatibility of your password change forms:

- Use semantic HTML elements such as `<form>`, `<label>`, and `<button>`.
- Verify that labels are properly linked to inputs using the `for` and `id` attributes.
- Show password rules with attributes like `minlength` or `pattern`, and provide inline guidance.
- Display a confirmation or error message in proximity to the form.