Password managers
Apple Passwords privacy rating
Apple's password manager, built into iOS, iPadOS and macOS as the Passwords app and synced through iCloud Keychain. It stores passwords, passkeys and verification codes, with an iCloud app for Windows.
Summary
Apple Passwords scores 64 out of 100 (grade C) on the password managers criteria. It meets 6 of 11 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, security headers and end-to-end encrypted vault. It partly meets no trackers or telemetry, local or self-hosted option and full export. It does not meet open source and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.
Score 64 out of 100. How scoring works
Criteria
- No
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
Device analytics are shared with Apple only with consent, but Apple's websites load first-party analytics by default.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
The Passwords app has no ads, and Apple states it does not sell or share personal data.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Apple publishes government request counts and outcomes twice a year.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Apple notifies customers when their account information is sought, unless notice is prohibited or in emergencies.
-
Yes
End-to-end encrypted vault Weight 3 of 3
Is the vault encrypted on the device before it is synced, with a key the provider does not hold?
Passwords and Keychain are always end-to-end encrypted, and Apple does not have the keys.
-
Partial
Local or self-hosted option Weight 2 of 3
Can the vault be kept locally or on your own server?
Passwords can stay on one device without iCloud sync, but there is no file or self-hosted option. Data can be exported.
-
Partial
Full export Weight 1 of 3
Can every item be exported in an open format?
Passwords can be exported to a CSV file on a Mac. No export is documented for passkeys.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Yes
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade A+ (130/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.