Is it safe to let Chrome remember all my passwords? I opened the password settings after Chrome filled a login on the wrong account and found 47 saved entries. This is my main laptop, but another person occasionally uses the same user profile. I use a screen lock, yet I am not sure what that protects if the browser is already open. Should I remove the saved passwords, change a Chrome setting, or keep using it as is?
The number of saved passwords is not the real problem. Sharing the same computer user profile is. A screen lock only protects the laptop while it is locked. If someone uses your already-open session, Chrome may autofill logins or expose access to accounts without them knowing the actual passwords.
Give the other person a separate operating-system account, or at minimum a separate Chrome profile and never hand over yours while it is open. Turn on device authentication before password filling if Chrome offers that setting, and remove incorrect or obsolete entries. For important accounts, enable two-factor authentication too.
You do not need to delete everything and return to memorizing passwords. Chrome is reasonable for a device only you use, but a dedicated free password manager such as Bitwarden gives you clearer locking controls and a separate master password. Just set it to lock automatically. Moving passwords without fixing the shared-profile setup would leave much of the same risk.
The easy-to-miss risk is Chrome sync: your Google account effectively becomes the key to that password collection. Check its recovery email, remove old signed-in devices, use a unique Google password, and enable two-step verification. @0xstack5 is right about separate computer accounts, but I’d secure the sync account before worrying about whether 47 entries is “too many.”
A separate Chrome profile is not really a security barrier if both profiles sit inside the same logged-in computer account. That confused me because profiles look like separate user spaces, but someone who has access to your Windows or macOS session may still be able to switch profiles or use accounts that are already signed in. A separate operating-system account is the safer fix.
The wrong-account fill does not mean Chrome mixed up or leaked your passwords. It usually means the site has more than one saved username, or the login form was changed and Chrome guessed which entry to use. Check the saved entries for that specific site, delete old usernames, and sign out of accounts you do not want left open. Forty-seven entries is not unusually dangerous by itself. Reusing the same password across those entries would be a much bigger concern.
I would keep password saving enabled rather than replace unique generated passwords with a few memorable ones. The practical rule is that your unlocked laptop should be treated like an unlocked password vault. When another person needs it, switch to their OS account instead of handing over your active session. A guest browser window is useful for a quick search, but it is not a substitute if they will use the computer regularly.
@chris64’s point about the Google account matters if sync is enabled. I would check whether you actually want password sync on every device listed on that account. Remove devices you no longer own, secure the Google account with two-step verification, and use passkeys or two-factor authentication on important sites where available. That makes Chrome’s password storage reasonably safe for normal use, provided your own computer session is kept private.
Realistically, you do not need to clean out 47 entries tonight, and deleting them all could create a bigger mess if some are the only copy of a password you no longer remember. Start with the account that filled incorrectly. Remove duplicate usernames for that site, confirm which login still works, and check whether Chrome saved the same site under slightly different addresses.
Then run the password check for reused or exposed passwords. Deal with your email account, banking, cloud storage, and social accounts first. A collection of 47 unique passwords is much safer than ten passwords reused across 47 sites. Before changing an important password, make sure its recovery email and phone number are still yours and save any recovery codes somewhere private.
Be careful with the tempting “export passwords” option. An exported password file is usually readable by anyone who gets it. If you make one while reorganizing or moving to another manager, import it immediately, delete the file, empty the recycle bin or trash, and check that it did not land in a synced Downloads folder or cloud backup.
I agree with @code_oleg79 that the separate operating-system account is the proper fix for the occasional user. In the meantime, the workable short-term rule is simple: fully sign out or lock your session before handing over the laptop. Do not rely on closing the Chrome window, since account sessions and background apps may remain available. Chrome saving passwords is acceptable here, but only after you stop treating your active computer session as shared space.
Realistically, no password setup survives a shared computer where someone else can reach your unlocked session. That’s the honest expectation here, and it’s why swapping Chrome for something else doesn’t change your core problem. Everyone above circled this, but I think it’s worth saying plainly: the tool matters less than who can touch the machine while you’re logged in.
Where I’d push back a little is the framing that 47 entries is fine as long as they’re unique. That’s true for the passwords themselves, but a big saved collection is only as strong as the weakest recovery path behind those accounts. @chris64 nailed the real weak spot with the Google account. If sync is on and that account has a stale recovery email or no two-step, the number of saved passwords is almost irrelevant, because someone resetting your Google login walks into all of them at once. Fix that before you touch anything else.
@code_oleg79 is right that a separate Chrome profile is theater if both sit under one OS login. Worth adding the annoying detail people skip: setting up a second operating system account on Windows or macOS is a bit of a chore, and the occasional user has to actually stay in their own account and not just click back into yours out of habit. If they won’t do that, the separate account buys you nothing. Guest mode on Windows or a standard (non-admin) second account is the low-effort version if you don’t want to manage a full profile.
On the Bitwarden suggestion, I can see why it came up, and the auto-lock control is a genuine reason to prefer it over Chrome’s built-in storage. But moving 47 entries into it while your OS session is still shared just relocates the same risk into a nicer box. Get the shared-session fix done first, then decide if you even want to migrate. Chrome’s saving is acceptable for a private session, and a dedicated manager is better mainly because it locks independently of your browser being open.
One thing nobody flagged: check whether the person who occasionally uses the laptop has ever been prompted to save their own logins into your Chrome. Mixed saved credentials from two people is exactly the kind of thing that causes the wrong-account autofill you noticed in the first place.
Deleting the 47 passwords would not make this laptop safer if you replace them with reused or memorable passwords. Saved logins have a useful side effect: Chrome normally will not fill them on a lookalike domain, so an unexpected failure to autofill can warn you that you are on the wrong site.
The caveat is browser extensions. Remove extensions you no longer need, especially anything allowed to read and change data on every website. A separate OS account fixes the occasional-user problem, but a malicious or abandoned extension runs inside your own browser session. Keep the saved passwords, clean up duplicate entries, and be selective about what you install in Chrome.