Which password managers change a breached password for you?
Google Password Manager is the only one shipping today, and Apple has announced a second for later in 2026. Both are locked to their own ecosystem. Bitwarden sits between the two states: on Premium and Families it detects the breach, opens the change page and fills the fields, then hands the form back to you. The remaining eight alert you and stop there, or built the feature and removed it. Read the middle column first.
- What we measured
- Whether the product itself will change a password on the real website after a breach or on a schedule, versus only detecting and alerting. Four outcomes: Automatic, Takes you there (detects, navigates and fills, but does not submit), Discontinued, or Alert-only and Manual. The third state was added on 4 August 2026 after Bitwarden's documented behaviour proved that two buckets could not describe eleven products honestly.
- Sample
- Eleven password managers: 1Password, Apple Passwords, Bitwarden, Dashlane, Google Password Manager (Chrome), Keeper, KeePassXC, LastPass, NordPass, Passbolt, Proton Pass.
- Method
- Vendor documentation, developer docs, source code and release notes, every document opened and read across July and August 2026. Hands-on account access reached 1 of the 11, Bitwarden. NordPass was signed up for on 4 August 2026 and its breach scanner was never run, because the feature sits behind a checkout page. That gating is reported as a first-hand observation, not as a feature test. Chrome and Apple entries reflect announced capability and published requirements, not measured per-site coverage.
- Window
- July 2026. The table is re-verified when any vendor ships or removes the capability, with the change dated on this page.
- Not measured here
- Per-site success rates and time-to-change, which is a separate reset-friction benchmark still in progress, and free-tier paywall placement.
Why do so few password managers change passwords for you?
Password managers stopped short of changing passwords for one structural reason: there is a proposed standard for finding a site's change-password page, and it is still a draft that most of the web ignores. Six things follow from the table and from building the thing.
The standard exists, and that is the problem.
/.well-known/change-password is still a W3C Working Draft and has never reached Recommendation, so a tool cannot assume any given site answers it. Bitwarden's client, in PR 13279 merged on 13 February 2025, probes the site first and falls back to the plain saved URL when the probe fails. That is an implementation shipping at scale while explicitly declining to trust the standard. Rekey reached the same conclusion independently and curates its URLs rather than guessing, because a guessed link returns a 404 on most sites.
A login form takes 360 shapes.
Rekey's coverage matrix generates every combination of 5 container types, 2 markup styles, 3 submit styles, 3 field-tagging states and 4 form kinds, then runs the shipping engine against each one in headless Chromium. An engine assuming a login is a plain form of plain inputs in the top document reaches 72 of them, which is the single clearest measure of why hand-built per-site automation collapses. The other 288 are forms inside iframes, inside shadow DOM, inside nested shadow roots, forms with no form element at all, and forms that never fire a submit event. Measured 5 August 2026: Rekey handles 360 of 360.
Both products that can do it are locked to one ecosystem.
Apple will cover Apple devices and Safari from iOS 27, and limits the feature to what it calls “eligible accounts” without defining eligible. Chrome covers participating sites for synced, US, adult users, starting on Android. A Windows user with a Firefox habit, or anyone outside the US, is covered by neither. Cross-platform, any-site password fixing does not exist as a shipping product in August 2026.
The feature has a graveyard, and it reads two ways.
Dashlane, a funded market leader, relaunched Password Changer in 2021 and retired it in 2022 having covered more than 500 sites. One reading is that the capability is wanted and hard, which fits Google and Apple both restricting their versions rather than abandoning them. The competing reading is simpler and deserves stating: a feature that shipped and died is decent evidence the demand was not there. KeePassXC issue 2772, “Automatic password changes”, opened 8 March 2019 and closed with no assignee and no pull requests, predicted the coverage problem before Dashlane proved it, seven years apart.
Detection is near-universal, but it is not free.
Detection ships in 10 of the 11 products in some form, from continuous dark-web monitoring to a check that only runs when you save a password, so the warning itself no longer differentiates anyone. KeePassXC is the only one shipping none, by design. Not one of the nine dedicated managers closes the loop by changing the password. It is worth resisting the word commoditised, though: in 4 named cases the detection sits behind a paywall, being Bitwarden Premium, NordPass Premium, Keeper's BreachWatch add-on and Passbolt Pro, and something a user has to pay for is not commoditised. The result is still a growing pile of red warnings and a to-do list nobody clears by hand. Our breach response guide is the manual version of that work, and our breach checker tells you which accounts are in it.
Open source is not the blocker.
4 of the 11 are open source, being Bitwarden, Proton Pass, KeePassXC and Passbolt, and none changes a password end to end, though Bitwarden gets closest and did so on paid tiers. The gap is a capability gap, not a licensing one.
Straight answers
Key takeaways
How we keep this current
The table is re-verified whenever a vendor ships or removes auto-change, and every correction lands on this page with a date. Found something we missed? Open an issue on the public repo and we will test it and update the table with credit.
Honest caveats
Apple's feature is announced and not yet shipped, so it is marked Announced rather than Yes and is excluded from the headline count. Apple's and Google's supported-site lists and success rates are not public, so their rows reflect announced capability, not measured coverage. We found no current documentation for LastPass's legacy auto-change and have not asserted anything about it either way. Hands-on account access reached one of the eleven. Every other row rests on vendor documentation, published source code or release notes, each opened and read. Rekey appears in the table for transparency and is not counted in any statistic.
Changelog
11 August 2026. The Passbolt row now records the Pro and Cloud create-time leaked-secret check, read from passbolt.com/docs/admin/resource-policies/password-policy on 11 August 2026. Leaving it out had put the detection count in conflict with this page's own statement that Passbolt Pro paywalls detection, so the count moves from 9 of 11 to 10 of 11, with KeePassXC the only product shipping none. The W3C draft's start year was removed from three sentences as unsourced; the draft status itself is unchanged and is the part the argument rests on. The downloadable CSV is now generated from this table, after it was found still carrying three claims this changelog had already corrected.
5 August 2026. Dashlane's coverage corrected from roughly 100 sites to 500+, and the claim that Dashlane called the feature unsupportable was removed as unsourced. Apple's "curated site list" replaced with Apple's own undefined term "eligible accounts". Bitwarden moved to a third state after its 18 December 2025 blog post confirmed it navigates and fills but does not submit. The LastPass "unmaintained" claim was cut. The NordPass row was corrected: its scanner was never run, so the entry reports paywall gating observed first-hand on 4 August 2026, not a feature test.
8 August 2026. Page rebuilt on the current design system. No claim, number or source changed.