How to find reused and weak passwords (and which ones to fix first)
Most people know they "shouldn't reuse passwords". Fewer know which of their own passwords are reused, and where to start fixing them.
This guide shows how to find them with tools you probably already have, and what to fix first.
In this article:
- the three kinds of password problems to look for
- how to run Google's Password Checkup in Chrome
- the order to fix things in
- how to handle an exported password file safely
Three problems to look for
Google describes the three things its Password Checkup looks for:
| Problem | Why it matters |
|---|---|
| Compromised | The username and password have been published online after a breach |
| Reused | One leak opens every account that uses the same password |
| Weak | Obvious phrases, keyboard patterns and single words are easy to guess |
Check in Chrome (Password Checkup)
If you save passwords in Chrome:
- Open Chrome on your computer.
- Open the More menu (top right) → Passwords and autofill → Google Password Manager.
- Select Checkup on the left.
Other browsers and password managers have similar checks. Look for "password health", "security" or "watchtower" in their settings.
What to fix first
- Compromised passwords: change these first, starting with any account that matters.
- Your email account: it can reset every other password, so it should have a unique, long password and two-factor authentication.
- Money and work: banking, cards, payment services, accounting, cloud storage, and anything with customer data.
- Reused passwords: give every account its own password. Let your password manager generate long random ones; you don't need to remember them.
- Weak passwords: the rest, as you go.
Turn on two-factor authentication (or use passkeys) wherever it is offered, starting with email.
If you export your passwords
Some tools, including our own, work from an exported password file. In Chrome, export is under Google Password Manager → Settings → Export passwords → Download file.
That file contains every password in plain text. So:
- check it on your own computer only, and don't email it, chat it or upload it to cloud storage
- delete it as soon as you are done, and empty the trash
A checker that stays in your browser
I made PassAudit, a password checker that reads an exported password file (CSV) and lists reused, weak (short, common, keyboard patterns and so on) and similar passwords (the same password with a different number or symbol at the end, like Neko2023! and Neko2024!). It runs entirely in your browser, and passwords are not sent anywhere. It does not check against breach databases, so use your browser's Checkup for that.
You can open the trial from "Free tools you can use" below this article.
Summary
- Look for three problems: compromised, reused and weak passwords
- Chrome: More → Passwords and autofill → Google Password Manager → Checkup
- Fix compromised passwords first, then email, then money and work accounts
- Give every account its own password and turn on two-factor authentication
- An exported password file holds every password in plain text: keep it local and delete it
Sources: Google Chrome Help: Manage passwords in Chrome · Google Account Help: Password Checkup
General information. This article was drafted with the help of AI and checked against Google's help pages on 2026-10-21. Menu names can change between versions.