# Apple Passwords privacy rating

Apple's password manager, built into iOS, iPadOS and macOS as the Passwords app and synced through iCloud Keychain. It stores passwords, passkeys and verification codes, with an iCloud app for Windows.

## Summary

Apple Passwords scores 64 out of 100 (grade C) on the password managers criteria. It meets 6 of 11 criteria: no ads or data sales, transparency report, tells users about requests, TLS configuration, security headers and end-to-end encrypted vault. It partly meets no trackers or telemetry, local or self-hosted option and full export. It does not meet open source and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://support.apple.com/guide/passwords/welcome/mac
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: iOS, macOS, Windows
- Home page trackers: none found
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Also rated: [iCloud Mail](https://privacyratings.com/email-providers/icloud-mail/) (Email providers), [Hide My Email](https://privacyratings.com/email-forwarding/hide-my-email/) (Email forwarding and aliases), [Apple Mail](https://privacyratings.com/email-clients/apple-mail/) (Email clients), [Safari](https://privacyratings.com/browsers/safari/) (Browsers), [Apple App Store](https://privacyratings.com/app-stores/apple-app-store/) (App stores), [FileVault](https://privacyratings.com/file-encryption/filevault/) (File encryption), [iMessage](https://privacyratings.com/messengers/imessage/) (Messengers), [FaceTime](https://privacyratings.com/video-calls/facetime/) (Video calls), [iOS](https://privacyratings.com/mobile-operating-systems/ios/) (Mobile operating systems), [macOS](https://privacyratings.com/desktop-operating-systems/macos/) (Desktop operating systems), [Spotlight](https://privacyratings.com/launchers/spotlight/) (App launchers), [Apple Notes](https://privacyratings.com/notes/apple-notes/) (Notes), [Apple Journal](https://privacyratings.com/journaling/apple-journal/) (Journaling apps), [Apple iWork](https://privacyratings.com/office-suites/apple-iwork/) (Office suites), [QuickTime Player](https://privacyratings.com/screen-recording/quicktime-player/) (Screenshots and screen recording), [Apple Books](https://privacyratings.com/ebook-readers/apple-books/) (Ebook readers), [Apple Dictation](https://privacyratings.com/speech-to-text/apple-dictation/) (Dictation and transcription), [iCloud Drive](https://privacyratings.com/cloud-storage/icloud-drive/) (Encrypted cloud storage), [Apple Maps](https://privacyratings.com/maps/apple-maps/) (Maps and navigation), [SwiftUI](https://privacyratings.com/app-frameworks/swiftui/) (Cross-platform app frameworks), [Apple Home](https://privacyratings.com/smart-home/apple-home/) (Smart home), [Apple Watch](https://privacyratings.com/wearables/apple-watch/) (Wearables and health), [Apple Health Cycle Tracking](https://privacyratings.com/period-trackers/apple-health-cycle-tracking/) (Period trackers), [Apple Music](https://privacyratings.com/music-streaming/apple-music/) (Music streaming), [iCloud Photos](https://privacyratings.com/photo-management/icloud-photos/) (Photo management)
- Grade: C (64/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Partial | Device analytics are shared with Apple only with consent, but Apple's websites load first-party analytics by default. | https://www.apple.com/legal/privacy/data/en/device-analytics/ |
| No ads or data sales | Yes | The Passwords app has no ads, and Apple states it does not sell or share personal data. | https://www.apple.com/legal/privacy/en-ww/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | Apple publishes government request counts and outcomes twice a year. | https://www.apple.com/legal/transparency/ |
| Tells users about requests | Yes | Apple notifies customers when their account information is sought, unless notice is prohibited or in emergencies. | https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.icloud.com&hideResults=on |
| Security headers | Yes | Grade A+ (130/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.icloud.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Passwords and Keychain are always end-to-end encrypted, and Apple does not have the keys. | https://support.apple.com/en-us/102651 |
| Local or self-hosted option | Partial | Passwords can stay on one device without iCloud sync, but there is no file or self-hosted option. Data can be exported. | https://support.apple.com/guide/passwords/export-passwords-mchl35b12625/mac |
| Full export | Partial | Passwords can be exported to a CSV file on a Mac. No export is documented for passkeys. | https://support.apple.com/guide/passwords/export-passwords-mchl35b12625/mac |

Source: https://privacyratings.com/password-managers/apple-passwords/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/apple-passwords.md