Is It Safe to Let Your Browser Save Passwords?

Yes, on your own devices it is safe to let your browser save your passwords, and the National Cyber Security Centre calls it the easiest way to remember them¹. The exception is a shared computer outside your home, such as one at a college or a library, where you should never let the browser save a password¹. On a device shared inside your household, the decision is yours: think about who else could reach your accounts, and if you are unsure, do not allow it¹.

That single rule covers most households. The reason it matters is that a browser can only remember a password if it is allowed to store it, and anything stored on a machine can be reached by anyone who can use that machine. On a phone or laptop that only you use, and that is protected by a password or fingerprint, that circle is just you. On a library desktop it is everyone who sits down after you.

The rest of this page sets out how to use browser saving well, where it stops being safe, how to handle a shared family tablet, and how passkeys fit alongside the passwords you already have.

Saving passwords in your browser is safe on your own devices

The NCSC's position is plain. Most web browsers will offer to save your passwords, and it is safe for you to let them, unless you are using a shared computer outside your home, for instance at college or a library¹. On the phone, tablet or laptop that belongs to you and stays with you, tapping save is a sensible default rather than a risk.

What makes it safe is the combination of the device and the lock on it. A saved password sits inside the browser on that one machine. If the machine has its own password, PIN or fingerprint lock, someone who picks it up cannot simply open the browser and read your logins. Age UK's guidance for staying safe online starts in the same place: password-protect any devices, and download anti-virus and anti-spyware protection for tablets and phones². The device lock is the foundation; browser saving is what you build on it.

There is a second reason the NCSC favours it. The advice for years has been to use a different password for every important account, because reusing one means a single breach can open several doors³. In practice almost nobody can memorise dozens of strong passwords. A browser that remembers them removes that obstacle, so you can accept the strong, separate password each site generates instead of falling back on one you use everywhere.

Why a browser password manager is the easiest way to remember passwords

A password manager stores passwords safely for you, which means you can have a unique password for each service without needing to remember them all¹. The one built into your browser is the version most people already have, with no extra app to install and no new account to set up. It fills in the login when you return to a site, and it offers to generate a strong password when you create one.

The NCSC encourages people to use password managers, which can create strong passwords for you and remember them⁴. Its top tips poster puts the same point as a question and an answer: if you need help remembering all your passwords, use a password manager⁵. For a household with no technical background, the browser's own manager is the lowest-effort way to act on that.

There is a difference worth knowing between the two kinds:

The NCSC notes that one of the main benefits of a third-party manager over the one in your browser is that it can synchronise passwords across a mix of different browsers and devices¹. If your household uses an iPhone, an Android tablet and a Windows laptop between you, that may matter. If you mostly use one device, the browser's own manager does the job. Our page on whether you need a password manager sets the two side by side in more detail.

Whichever you choose, the passwords inside it should still be strong. The NCSC recommends three random words, such as "BallDogRed", to create memorable but strong passwords⁶, and warns against predictable ones such as dates, family and pet names, or "1234"⁷. A manager makes those easy to use because you are not relying on memory.

Where browser saving is not safe: shared computers

The line the NCSC draws is between your own devices and a shared computer outside your home. You should never save your password in the browser on a shared device such as a desktop computer at a college, library or other public place¹. The same caution applies to password managers generally: only use one on your own computer, shared only with people you trust, and not in a public place like a library².

The reason is straightforward. A browser that has saved a password will offer it to the next person who opens that site on that machine. On a library computer, that person is a stranger. Signing out at the end does not necessarily remove a saved password, so the safe habit is to decline the save prompt in the first place, and to sign out when you have finished.

Public networks carry their own risk. The Police Service of Northern Ireland warns that public Wi-Fi hot-spots may not be secure⁸. If you are signing in to anything sensitive on a shared or public machine, do it over a connection you trust, and keep the session short.

If you do need to keep a password to hand while out, do not leave a written note near the computer. The RNIB advises that if you need to write a password down, put it somewhere safe that you will remember but where someone else is unlikely to find it⁹. Our page on writing passwords down covers how to do that well.

Shared household devices: decide who could reach your accounts

A device shared inside the home is a different case from a library computer, because the people who could reach your accounts are your own household. The NCSC's advice is to decide whether you are comfortable with others potentially accessing your accounts, and if you are unsure, the safest option is simply not to allow your browser to save passwords when it asks¹.

That is a judgement, not a rule, and it depends on the device and the people. A tablet passed around the family, a teenager's laptop, a computer in a shared room: each widens the circle of people who could open a browser and use a saved login. A phone that stays in your pocket does not.

A few practical steps reduce the risk without giving up the convenience:

• Give each person their own account or profile on a shared computer, so each browser keeps its own saved passwords.
• Lock the device itself. Age UK advises password-protecting any devices²; a lock screen is what stands between a saved password and someone else's hands.
• Keep the important accounts separate. The NCSC says you should ideally use unique passwords for all your important online accounts, such as banking, shopping and payment accounts and social media, not just your email³.
• Turn on two-step verification. This gives you a code to enter from an app or SMS, so even if a criminal knows your password, they will not be able to access your accounts⁷. Our guide to turning on 2-step verification walks through it.

If you are still unsure, the NCSC's fallback is the safe one: do not allow the browser to save passwords¹. You can always turn saving back on once you have decided.

Phishing, breaches and what to do if a saved password is exposed

Saving a password in your browser does not make you more likely to be phished, but it changes what happens if you are. Phishing means scam emails or text messages containing links to websites that may carry malware, or may trick you into revealing sensitive information such as passwords¹⁰. A saved password is only offered to the site it belongs to, so a lookalike page at a different address will not be filled in automatically. The risk is being persuaded to type it yourself.

If you have given out a password, act quickly. The NCSC says you should change the passwords on any of your accounts where you use the same password, and if you have entered banking or card details, contact your bank straight away¹¹. If you use the same passwords on other accounts, change them immediately¹¹. If you have only clicked a suspicious link and entered nothing, downloaded no files and installed no software, it is unlikely you need to take further action, but stay alert to emails and notifications on your accounts for anything suspicious¹¹.

Passwords are also often stolen when an organisation holding your details suffers a data breach⁷. If a breach notice reaches you, and a suspicious message includes a password you still use, change it as soon as you can, change any other accounts using the same password, and consider using a passkey instead¹². Our page on your details in a data breach sets out the steps in order.

If an account has already been hacked, changing the password is only half the job. The NCSC advises logging out of the account on all devices and apps after changing it, usually from the settings, privacy or account menus¹⁴. This forces anyone already signed in to supply the new password¹⁵. Our guide to what to do if an online account is hacked covers the full sequence.

Passkeys: the NCSC's view of the future of login

The NCSC recommends making passkeys your first choice of login and using them wherever they are offered¹. In April 2026 it set out its view that passkeys are a more secure and user-friendly login method and should be the default option for consumers¹. A passkey replaces the password you type with a credential held on your device, which you unlock with your fingerprint, face or PIN.

That does not make your saved passwords redundant. Many accounts do not yet offer passkeys, and for those the NCSC's advice is to continue using a strong and unique password and two-step verification¹. So the practical position for a household today is a mix: adopt passkeys as each service offers them, and keep the browser's saved passwords and two-step verification for the rest.

A browser can hold both, so there is no need to choose between them. Our page on what a passkey is and whether to use one explains how to set one up.

Protecting the device that holds your passwords

Everything above rests on the device itself being locked. If someone can open your phone or laptop without a password, they can open the browser and use every password saved inside it. Age UK's advice is to start by password-protecting any devices, and to download anti-virus and anti-spyware protection for tablets and phones².

Smart devices in the home deserve the same attention. New security law means manufacturers must not supply devices that use default passwords, which can be easily discovered online and shared¹⁶, and the NCSC advises that if a device or app comes with a default password, you change it¹⁶. If a default password is left in place, a criminal could log into a smart device and use it to access a local network, or conduct cyber attacks¹⁶. Our guide to smart speakers, cameras and baby monitors covers this in full.

Backups need protecting too. The NCSC advises protecting your backup with a strong password in case the media is lost or stolen, so that someone who has the media cannot access your data¹⁷. If a device does become infected, antivirus products do not work in the same way on a phone or tablet as on a PC or laptop, and the safest solution is a factory reset, usually found in settings¹⁸. Our page on whether to factory reset an infected phone explains when that is the right step.

If you are still not sure

The NCSC gives a clear fallback for anyone uncertain: if you are not sure, the safest option is simply not to allow your browser to save passwords when it asks¹. That is not a failure. You can still have strong, separate passwords by writing them down and keeping them somewhere safe, which the NCSC says is fine provided you keep them somewhere safe⁶. It notes that writing passwords down can be done safely because an attacker would need physical access to where they are stored, and that it can suit people who need regular support to manage their online affairs¹. Check first that you are not breaking a service's terms and conditions, as some online banking services forbid writing down passwords, and consider who has access to where they are kept¹.

If you have been caught by a scam, report it. You can report suspicious emails, websites and phishing to the government's reporting service¹⁹, and the NCSC will analyse the suspect email and any websites it links to²⁰. Our pages on how to report a phishing email and how to report a scam text message give the steps. For the wider picture, see our guide to protecting email and bank accounts and the home online security checklist.