Credential Health¶

Credential Health looks over your logins and tells you, in points, how much safer each one could be. A login with nothing left to improve scores 0, and every point is something you can fix. The app puts them up one at a time, so it never becomes a chore.

Everything is worked out on your own devices: nothing is sent to anyone to do it.

Which items it looks at¶

Every item with a password or a passkey, whatever its Type: a website's login, and a Wi-Fi network's password too. The app calls each of these a login. Archived items and the Bin's are left out (see What is left out).

What it checks¶

	What it checks
Strength	How long the password would last in the worst case: a breached site that stored its passwords badly, and a trillion guesses a second. Dangerous lasts under a week, Weak under three months, OK under three years, and Strong longer than that.
Repeats	Whether another item uses the same password, now or as one of its previous passwords. A breach of one site then exposes every site that shares it.
Age	Whether the password is older than its Type's Password Age. See Password Age and Rotation.
MFA	Whether the login has a second step after the password, such as a code or a security key.
Importance	Whether the login is one of those that matter most: your Apple Account, your email, your bank, your tax office.

A password the app generated is rated by its Password Template. One you typed or imported is checked against common passwords, words and names.

How repeats are found without reading your passwords

Each password is given a fingerprint, made with a secret key kept in your Keychain. Two equal fingerprints mean two equal passwords, so repeats are found without opening a single item. Without the key, a fingerprint says nothing about the password.

The score¶

The Credential Health page leads with your score: the points to gain across all your logins.

[Screenshot: the Credential Health page with its score]

Under the score you may see:

the highest score you've had, with its month, such as "From 8,647 in Oct-25";
how far you've come in a week, such as "12 points better this week. Well done.";
how many logins could be better.

In short, for each login:

a Dangerous password counts most, then Weak, then OK;
each other item using the same password, and each day past its Password Age, makes that count more;
MFA cuts it down, a passkey or a security key the most;
a website login with no MFA at all adds a point;
an important login counts three times.

How the points are worked out, exactly

Start from the password's rating: Dangerous 10, Weak 4, OK 2, Strong 1.
Past the Type's Password Age, multiply by the password's age divided by the Password Age, up to 5. A password 500 days old, against 250, doubles.
Multiply by the number of items using the password, this one included, up to 5.
Take away 1, so that a Strong password of its own, within its age, has no points.
Multiply by what the login's strongest MFA leaves: Text Message or Email 0.4; Phone Prompt or Call, or Other, 0.3; Authenticator Code, or a one-time code kept in the item, 0.1; Security Key or a passkey 0.05.
Add 1 if the login is for a website and has no MFA of any kind, unless it is marked Not Offered.
Multiply the lot by 3 if the login is important.

For example: a Weak password, 500 days old against a Password Age of 250, also used by one other item, with Text Message MFA, on an important login. 4 × 2 × 2 = 16; less 1 is 15; × 0.4 is 6; × 3 is 18 points.

A login whose rotation is deferred has no points at all. Points are shown rounded to whole numbers.

Where you see it¶

On a login. Open a login that could be better and a coloured message stands at its head: red Change This Soon from 10 points, orange Worth Improving from 3, and blue Nearly There below that. It says what's wrong, what would put it right and the points to gain, with a Change Password button where the password is the problem.
On the rows. Marks at the end of a row: a skull, red for a Dangerous password and orange for a Weak one; two keys and a number for a repeated password, orange where two items share it and red for three or more; and an hourglass for an old password, orange and then red. A green key badge marks a login with a passkey.
On Recent. A pill for each kind of warning some item carries. Choose one to list only those items.
On Info. The Credential Health line, just under the summary of your items: a bar in the ratings' colours, with a count beside each warning. Choose it to open the Credential Health page.

[Screenshot: rows on Recent with the skull, two keys and hourglass marks]

The Credential Health page¶

Open it from the Credential Health line on Info. Below the score:

Make It Better: Important Logins and MFA (both below), and Passkeys Explained.
Go Through Every Problem opens Recent with only the items that have a problem.
Strength: your passwords by rating. Dangerous and Weak each open Recent with just those items.
Repeated: Used by another item.
Age: Past their age, and how many are half as old again.

Important logins¶

An important login counts three times and is put up first. To mark one, open it and turn on Important Login under Sign-in Protection. To go through many at once, open Important Logins on the Credential Health page, choose a Type or Not Yet Set, and choose each login's Important pill. Each choice is saved at once.

Some sites are suggested as important, and count as important until you say otherwise. Their pill says Suggested. They are:

government sites, and any site ending in .ai;
banks, payment services and crypto exchanges;
mail providers, since a mailbox can reset every other password;
phone carriers, since whoever holds that account can move your phone number, and the codes sent to it;
domain registrars, password managers and large technology companies.

Streaming, music, games, news and shopping aren't on the list, apart from Amazon and eBay, which hold cards and money.

MFA¶

MFA is the second step a site asks for after the password. Tick each kind a login has, under Sign-in Protection on the open login, or on the MFA page from Credential Health. You can tick several:

Text Message, Email, Phone Prompt or Call, Security Key, Authenticator Code and Other.

A login given a one-time code has Authenticator Code ticked for you: see One-Time Codes.

Tick Not Offered for a site that has no MFA, so the login isn't counted as missing it. A login whose one-time code is kept in Private Passwords already counts as having an authenticator code, and a passkey counts as much as a security key.

What sites offer¶

iPhoneMac

With Check What Sites Offer on, in Settings under Credential Health, the iPhone fetches the public lists of which sites offer MFA and passkeys: the 2FA Directory and the Passkeys Directory, both run by 2factorauth. It fetches each list whole, at most once a month, so nothing of yours is sent, and matches it against your sites on the iPhone. A login then shows what its site offers, such as "Offers: Authenticator Code, Passkeys", and its advice takes that into account.

Check What Sites Offer is on unless you turn it off. Nothing is fetched while Credential Health is off.

The Mac never fetches these lists. It shows what your iPhone found, when your items sync through iCloud Keychain.

The box on Recent and Tags¶

At the top of Recent and Tags, a box puts up one login at a time to fix: the important ones first, then those with the most points. It shows your score, the login, what's wrong with it, the points to gain, and how many you've fixed today.

[Screenshot: the Credential Health box at the top of Recent]

Open opens the login.
Skip puts up the next one. This one may come back tomorrow.
Defer leaves this login out of Credential Health for 1, 3 or 6 months, or forever: see Defer Password Rotation. It counts as fixed today.
The × rolls the box up into a thin red bar, and no login is put up again until tomorrow. Choose the bar, or pull it down, for the next one.

iPhoneMac

You can also swipe the box away, in either direction.

Click the ×.

A login counts as fixed once its points fall after the box has shown it, say with a new password, MFA or a passkey, or once it's archived or deleted. Fixes count on every device your items sync to. While a warning pill limits Recent, the box stands aside.

Max Bad Credential Health Items per Day, in Settings under Credential Health, sets how many fixes the box asks of you in a day: 2 unless you change it, from 0 to 9. Once that many are fixed, the box rolls up into its bar until tomorrow; pull the bar down if you'd like to do more. With 0 there's no box at all.

Turning Credential Health off¶

Manage Credential Health, in Settings under Credential Health, is on unless you turn it off. Each device has its own.

Turned off, Credential Health shows nothing: no score, no box, no marks on the rows, no warning pills, no line on Info, and no message or Sign-in Protection on a login (a passkey still shows). Two things stay: the rating under a password as you type it in the editor, and the Credential Health page at the end of an import.

Nothing is deleted. Turn it back on and everything returns at once.

What is left out¶

The archive and the Bin. Their items are never scored, counted or put up. One thing to know: an archived item still counts as another item using the same password. An item in the Bin doesn't.
Items with no password and no passkey, such as notes and cards.
A login whose rotation is deferred, until the date you chose.

Continue to Password Age and Rotation.