Password Monitor

Strong data protection is more important than ever in today’s evolving security landscape—when a site or app gets hacked, your username and password could end up public on the dark web. If you reuse that password on other sites, attackers may try it elsewhere. Password Monitor helps you catch these risks early and protect your other accounts.

Once enabled, Edge securely checks your saved credentials against a constantly updated database of leaked credentials. The check is encrypted and private—only you can see which passwords are flagged. Edge does not store or send your plain-text passwords.

When first enabled, all saved passwords are scanned at once. After that, Edge automatically scans each credential whenever it is saved or auto-filled. You can also run a manual scan at any time using the Password security check option in Microsoft Password Manager within Edge’s Passwords and autofill section.

Flagged credentials appear under the Password security check page. You can choose to change the password immediately, dismiss the alert if the account is no longer in use, or add it to an ignore list. For supported sites, clicking “Change” opens the site’s change password page directly. For sites that are not supported, users are advised to go to the website themselves and change it.

Only passwords you’ve saved in Microsoft Edge are monitored. Also, Password Monitor relies on known leak databases—very new leaks or credentials not yet in those databases might not be detected. That’s why using unique, strong passwords for every account remains important.

It depends. If you’re signed in to Microsoft Edge and syncing your passwords, Password Monitor is automatically enabled. If you’re not signed in, not syncing, or using a managed device, you may need to turn it on yourself.

To check your settings, go to Settings ▸ Passwords and autofill ▸ Microsoft Password Manager ▸ More settings ▸ and make sure "Scan passwords for leaks" is switched on (the toggle will be to the right and highlighted in blue).

You’re in control—you can dismiss or ignore alerts for old or unused accounts, so notifications stay meaningful and relevant.

Yes. You can disable the feature at any time in Settings ▸ Passwords ▸ Microsoft Password Manager ▸ More Settings ▸ Scan passwords for leaks.

No. Password Monitor is just one of several layers of protection. Using unique, strong passwords (or passkeys), enabling two‑factor authentication, and practising safe browsing habits all help to maximise your account security. Learn more about how to protect your online accounts using Password Monitor.