Is Google Password Checkup Legit? What It Actually Sends to Google

"Is Google Password Checkup legit?" is a reasonable thing to type before handing a security tool anything at all. The short answer is yes, it is a genuine Google feature. But the question people are really asking sits one layer down: if it checks my passwords against breach databases, does Google see my passwords?

That one has a precise, documented answer.

Password Checkup tells you which saved passwords appear in known breaches. For the other half of the job, our free password CSV converter reads the passwords file you export from Chrome or Google Password Manager and lists every password reused across sites, every short one and every login still on http, entirely inside your browser (nothing is sent to us or to Google). Delete the .csv once you are done.

What it is

Password Checkup compares credentials you have saved against a set of credentials known to have appeared in third-party data breaches, and tells you when one of yours turns up. Google introduced it on its own Online Security Blog in February 2019.

The premise is simple. Billions of username and password pairs have leaked over the years. If one of yours is among them, and you are still using it, anyone working through those lists can walk into that account. Checking is worth doing.

The privacy problem it had to solve

Here is the difficulty, in Google's own framing. The feature needs to query the breach status of a username and password without revealing the information queried. At the same time it must ensure that no information about other unsafe credentials leaks in the process, and that brute force guessing is not an option.

Those requirements pull against each other. A naive implementation would send your password, or a simple hash of it, to a server and ask "is this in the list?". That hands the server exactly what it should never receive.

How it avoids sending your password

Google describes the approach as using multiple rounds of hashing, k-anonymity, and private set intersection with blinding, chosen to balance privacy, computation overhead and network latency.

Each piece does a specific job:

Multiple rounds of hashing mean the raw value never leaves your device, and the derived value is expensive to attack by brute force.

k-anonymity groups your query with enough others that it cannot be tied to you specifically. It also prevents the check from leaking information about the other compromised credentials sitting in the database.

Private set intersection with blinding is the core of it. It allows two parties to work out whether an item is in a shared set without either side revealing what it holds. The blinding is what keeps the value you are checking unreadable to Google while the comparison still produces a correct answer.

The upshot: the answer comes back, and your password is not what travelled.

What it does not cover

This is where being honest matters more than being reassuring.

Password Checkup examines the credentials it can see, which means the ones saved in your Google account or browser password manager. That scope has real edges:

• passwords you have never saved to Google are invisible to it
• passwords kept only in a different manager are outside its reach
• old accounts you have forgotten cannot be checked, because nothing knows they exist
• it reports on breaches already in the dataset, so a leak that has not surfaced yet will not appear

None of that makes the tool bad. It makes it partial, and knowing where a tool stops is the difference between using it well and trusting it blindly.

What a warning actually means

A hit tells you that a credential matching yours has appeared in a breach somewhere. It is not a statement that this particular account has been broken into.

The correct response does not depend on that distinction:

1. Change the password on that account, to something unique that you have never used elsewhere.
2. Find where else you reused it. This is the step people skip, and it is the one that matters most: reuse is the mechanism that converts one company's breach into five of your accounts.
3. Turn on two-factor authentication on anything that offers it, so a stolen password alone stops being sufficient.

If step two feels impossible because you genuinely cannot remember where a password went, that is the actual finding. It is also the argument for a dedicated password manager: not because Google's checking is untrustworthy, but because a manager knows every credential you have, can generate unique ones, and can tell you about reuse before a breach does.

If you decide to move out of Google Password Manager

Checkup only sees what Google holds, so the useful move is to put every credential in one vault whose health check sees all of them, including the ones you use outside Chrome. Proton Pass reads the Chrome export directly (steps checked on proton.me on 18 October 2026):

Black Friday 2026 (read on 28 October 2026): the Proton Pass partner page our link opens takes 60% off the first year of Pass Plus ($23.88 for the first 12 months, then $35.88 a year) and Pass Family ($33.48 for 6 accounts, then $59.88 a year), with the 30-day money-back guarantee. The order page shows the price for your country, so check it before paying. See the Proton Pass Black Friday offer

1. In Chrome, open your profile picture, then Passwords and autofill, Google Password Manager, Settings, Export passwords. You get a .csv file (full walkthrough).
2. In the Proton Pass browser extension, go to Settings, Import, choose Chrome as the provider and drop the file in.
3. Delete the .csv once the item count matches: it is every password you own, in plain text.

On the free plan, Proton Pass's Pass Monitor flags weak and reused passwords and accounts where 2FA is available but inactive, which is exactly step two above. Dark Web Monitoring, which watches your email addresses for new breaches, needs Pass Plus (2.99 USD/month billed yearly).

The short version

Password Checkup is legitimate, and the privacy concern that sends people searching for reassurance is one Google engineered around rather than ignored: hashing, k-anonymity and private set intersection with blinding mean the check happens without your password being read.

Its limit is scope, not honesty. It sees what you have saved to Google, and nothing else. Use it, act on what it finds, and remember that the reuse it cannot see is the part most likely to hurt you.

The description of Password Checkup, including the stated design requirement to query breach status without revealing the queried information, and the use of multiple rounds of hashing, k-anonymity and private set intersection with blinding, comes from Google's Online Security Blog post introducing the feature in February 2019. Implementations evolve; verify current behaviour against Google's own documentation before relying on a specific detail. Commercial links carry the rel="sponsored nofollow" attribute; an affiliate commission may apply at no extra cost to you.