Should employees save work passwords in the browser?

Google Chrome and Microsoft Edge offer to save the passwords you type on sign-in pages and fill them in next time.

What the browser’s password manager does

The browser’s password manager does three things: it saves, syncs and fills in passwords. Syncing means the browser copies your saved passwords to your other devices through the account you signed in to the browser with.

CISA’s “Use Strong Passwords” page counts the password manager built into your browser as one kind of password manager. What matters at work is which account it saves to. A browser profile keeps one person’s bookmarks, history and saved passwords apart from another’s. Chrome’s help suggests separate profiles when several people share a computer, or when you want to keep work and personal accounts apart.

In Edge, enterprise sync uses a work account managed in Microsoft Entra ID. It requires a supported plan, such as Microsoft Entra ID P1 or P2 or Microsoft 365 Business Premium.

Where it causes trouble at work

Trouble starts when the place a password is saved or synced to reaches beyond work.

• Signed in with a personal account. Work passwords save to a personal Google Account or Microsoft account and sync to home devices. Sync follows the signed-in account, and it doesn’t know which passwords are for work.
• On a personal device. The password stays on the device and in the account after the person leaves. The company doesn’t manage either, so it can’t confirm the password was deleted.
• On a shared computer. Saved passwords fill in for everyone who uses that profile, because the browser saves per profile and doesn’t check who is sitting there.

A shared account’s password saved in a browser can end up in any of these three places, and it adds a problem of its own. Each browser that saves the password is one more place the password lives. When someone leaves and you change the password, each of those places is one more to update.

When it’s fine and when to avoid it

It’s reasonable when a person saves their own work login, in a company-managed profile, on a company device only they use. The saved password stays in places the company controls. When the person leaves, returning the device and disabling their account cuts it off.

Avoid the cases from the previous section. Don’t save passwords in a browser signed in to a personal account, on a personal device or on a shared computer. Don’t save a shared account’s password at all.

Even in the good case, the browser stores the password itself. The person who saved it can display it at any time. Chrome’s help shows how to reveal a saved password in Google Password Manager, and how to delete one. If your company already uses a separate password manager, the browser’s version duplicates it, so pick one.

Settings admins can use

Both browsers let admins block saving and syncing through policies they push to managed browsers. Here is what the official documentation shows.

Blocking saving stops new passwords from being saved. Choosing “Disallow Sync” in Chrome keeps browser data on the device only; “Disable browser sign-in” goes further and stops people signing in to Chrome at all. In Edge, applying SyncDisabled as mandatory means people can’t turn sync on.

Settings also help keep work and personal accounts apart. In Chrome, the “Separate profile for managed Google Identity” setting can force a separate profile when someone signs in with a company-managed Google Account. “Enterprise profile separation” can require a managed profile when a work account is added.

In Edge, the policy pages for PasswordManagerEnabled and SyncDisabled say they don’t apply to a profile signed in with a Microsoft account, meaning a personal one. SyncTypesListDisabled does apply there. Set it to “passwords” and passwords stay out of sync, and people can’t override it.

To cover personal devices and personal profiles fully, settings aren’t enough. Pair them with a rule that work happens only in the company-managed profile.

Passwords saved before the switch

Passwords saved earlier keep working after the policy arrives. Microsoft’s PasswordManagerEnabled page says people “can still use previously saved passwords,” and Google’s Chrome policy help says the same for Chrome. So when you switch to blocking, ask each person to delete their saved passwords. For a shared account, change its password, so the saved one stops working.