Google Just Deleted 17 Million Passwords Overnight

Google dropped a quiet bombshell this week: 17 million passwords, wiped. Not breached. Deleted. The company confirmed it purged credentials flagged as compromised across its Password Manager, the built-in vault that stores logins for Chrome and Android users. If your password was sitting in that pile, it's gone — and you'll be prompted to create a new one the next time you sign in. On the surface, this sounds like a security win. It mostly is. But the mechanics matter, and so does what this moment says about the passwords you're still using everywhere else. Here's what actually happened. Google runs continuous scans that cross-reference saved credentials against known breach databases — collections of leaked logins traded on forums and dark web markets. When a match surfaces, the account gets flagged. Historically, you'd get a warning. This time, Google chose the nuclear option for 17 million of them: automatic deletion. The upside is obvious. A compromised password sitting idle in your vault is a loaded weapon. Attackers don't need to hack you if they already have your credentials from a 2019 data dump you forgot about. Removing the ammunition is defensive hygiene at scale. The catch is friction. Deleted passwords mean locked doors for anyone who didn't have a backup or a recovery method. Google says users will be guided through resets, but anyone who used a unique, generated password they never memorized is now dependent on the recovery flow working cleanly. Usually it does. "Usually" is doing heavy lifting in that sentence. This also raises a bigger question about the model itself. Password managers have quietly become single points of failure for hundreds of millions of people. One vault, one master password, dozens or hundreds of credentials inside. That's a massive concentration of risk — and it's exactly why Google, Apple, and Microsoft have been pushing passkeys instead. Passkeys replace the password entirely. Instead of a string of characters, your device holds a cryptographic key, unlocked by your face or fingerprint. Nothing to steal from a breach database. Nothing to delete. Google has been rolling them out aggressively across its ecosystem, and this week's purge can be read as a nudge: the era of the typed password is winding down. But adoption is slow. Most Americans still juggle the same handful of passwords across dozens of accounts, recycling and tweaking as they go. That habit is why 17 million compromised credentials existed in the first place. Breach data doesn't lie — reused passwords are the connective tissue between unrelated hacks, letting attackers take one leaked login and pry open email, banking, and social accounts in sequence. So what should you actually do? First, if Google prompts you to reset, do it immediately — and don't reuse the old password anywhere. Second, check your other accounts against a breach-scanning tool. Third, turn on two-factor authentication everywhere it's offered. And fourth, if your bank, email provider, or workplace supports passkeys, switch. The technology is ready. Your habits are the bottleneck. For investors, there's a quieter signal here too. Google's willingness to act unilaterally on user data — even for protection — reinforces how much leverage the major platforms hold over digital identity. That power is a competitive moat, and it's only widening as passkeys make these ecosystems stickier. The 17 million deletions won't make headlines for long. But they mark a real inflection point: the world's largest password manager just admitted, in action, that passwords are a dying format. Our take: Google did the right thing, even if it feels abrupt. The uncomfortable truth is that most of us are one forgotten password away from a very bad week — and the companies holding our digital keys know it. Passkeys can't arrive fast enough.