Google has introduced a new feature in its Chrome browser that allows its built-in Password
Manager to automatically change a user's password when compromised credentials are detected.
"When Chrome identifies a compromised password during sign-in, Google Password Manager gives the user an option to fix it automatically," explained Google's Ashima Arora, Chirag Desai, and Eiji Kitamura. "On websites that support the feature, Chrome can create a strong replacement and update the password for the user on its own."
This feature expands on Password Manager's current functions, which include generating strong passwords at sign-up and alerting users when credentials have been exposed in a data breach.
With automated password changes, Google aims to reduce user friction and enhance account security without requiring users to search for account settings or abandon the process partway through.
Website owners can enable this feature by doing the following:
Use autocomplete="current-password" and autocomplete="new-password" to support autofill and password storage
Set up a redirect from <your-website-domain>/.well-known/change-password to the password change form on their site
"It would be much easier if password managers could take the user directly to the password change page," said Kitamura. "This is where a well-known URL for password changes becomes valuable. By reserving a standard URL path that leads to the password change page, websites can help users reach the correct location more efficiently."
This update arrives as many companies are moving toward passkeys as a more secure method for protecting accounts. Earlier this month, Microsoft announced that passkeys will become the default method for new customer account sign-ups.
Found this article interesting? Follow us on X(Twitter) ,Threads and FaceBook to read more exclusive content we post.
