TL;DR
Secure passwords, 2FA codes, and credit cards – all built into iOS and macOS. No extra subscription or third-party app required.
How to set it up
- Enable it: Settings → [Your Name] → iCloud → Passwords & Keychain → turn on.
- Save passwords: When you sign in on websites, iOS/macOS automatically offers to save the password – just confirm.
- Access: Settings → Passwords (iPhone) or Cmd+Space → type "Passwords" (Mac). Unlocks with Face ID / Touch ID.
- Generate strong passwords: When registering on a website, Safari suggests a secure password automatically – accept it, done.
- Set up 2FA codes: Go to Settings → Passwords → select a site → "Set Up Verification Code". Scan the QR code – iOS auto-fills the code from now on.
- Save credit cards: Settings → Safari → AutoFill → enable Credit Cards. Enter your card once, and it auto-fills during online purchases.
Why this works
iCloud Keychain is Apple's built-in password manager. Everything is stored with end-to-end encryption and syncs across all your Apple devices – iPhone, iPad, Mac. You don't need a separate subscription for 1Password or Bitwarden if you're fully in the Apple ecosystem.
Since iOS 18 and macOS Sequoia, there's even a standalone Passwords app that shows everything in one place: passwords, passkeys, Wi-Fi credentials, and 2FA codes.
Use the Security Check
Under Settings → Passwords → Security Recommendations, Apple automatically checks:
- Compromised passwords – has your password appeared in a data breach?
- Reused passwords – same password across multiple sites?
- Weak passwords – too short or too simple?
A red or yellow warning shows exactly where you need to take action.
Good to know
- Apple only: No native access on Android or Windows. If you work cross-platform, you'll need Bitwarden or 1Password.
- Password sharing: Since iOS 17, you can share passwords in a group (e.g., with family) – under Settings → Passwords → New Group.
- Passkeys: Apple also supports passwordless login via Passkeys. Where available, this is the most secure option.
- Export possible: You can export all passwords as CSV if you ever want to switch.