Google can read your passwords. By default, your saved passwords are encrypted with keys Google holds. A rogue employee, a government order, or a breach could expose every password you've saved. The 'on-device encryption' toggle exists but almost nobody finds it. The company that makes $265 billion selling ads stores every password you own. Their privacy policy lets them use your data to 'improve services and develop new ones.' Your banking password lives next to their ad targeting engine.
What they claim: Google Password Manager is embedded in Google Play Services (com.google.android.gms)
What we found: Google Play Services requests 37+ permissions including ACCESS_BACKGROUND_LOCATION, READ_SMS, CAMERA, RECORD_AUDIO, and AD_ID. Your password manager runs inside the same process that serves ads, tracks location, and reads SMS. No other password manager bundles with an advertising SDK.
What they claim: Google positions Password Manager as helping users 'stay safe online'
What we found: Google has paid $5.6B+ in privacy-related settlements and fines: $391.5M location tracking (2022), $5B-$7.8B incognito mode (2024), $22.5M FTC Safari cookies (2012), EUR 50M CNIL (2019), EUR 150M CNIL cookies (2022), EUR 325M CNIL (2025). The company storing your passwords has the worst privacy enforcement record in tech.
What they claim: Google Password Manager works 'seamlessly across devices' via Chrome sync
What we found: Chrome sync ties password management to Google account login. Signing into Chrome to use password management also enables browsing history sync, autofill sync, and extension sync — expanding Google's data collection well beyond passwords. The password manager is a funnel into broader surveillance.
What they claim: Google's privacy policy covers password data under the same terms as all Google services
What we found: Google generated $265B+ in advertising revenue in 2024. Your passwords are stored by the world's largest advertising company under a privacy policy that permits data use for 'improving services' and 'developing new ones.' The structural conflict between ad-funded business model and password security is fundamental.
What they claim: Google Password Manager is presented as a secure way to 'save and manage your passwords'
What we found: By default, Google Password Manager uses server-side encryption where Google holds the encryption keys. This means Google can technically read your passwords. 'On-device encryption' is available but opt-in and buried in settings. Most of the 3+ billion Chrome users are on the default setting where Google has access.
What they claim: Google claims passwords are 'encrypted and protected' in your Google Account
What we found: In July 2024, a Chrome bug locked 15 million users out of their saved passwords for 18 hours. Google classified plaintext credentials visible in Chrome's process memory as 'working as intended' rather than a vulnerability. Passwords are accessible in memory to any process with debugging access.
What they claim: Google Password Manager offers a 'Password Checkup' feature to detect breached credentials
What we found: Password Checkup sends hashed credentials to Google servers for comparison against breached databases. While the protocol uses k-anonymity, it still requires trusting Google's implementation. The company simultaneously runs the largest breach-check service and the largest advertising platform.