Is Chrome encrypted?
Only if you set a sync passphrase. Chrome connects to sites securely by default, but Google holds the key to the passwords, history and bookmarks you sync. With your own passphrase, Google can't read them.
Checked on 25 October 2026 against 4 sources.
Made by Secria. We grade every app by the same rules. How we check
- Connection to sitesOnly you and the siteSince October 2026, Chrome asks before it opens a public site that has no secure connection.2, 3
- Saved passwordsOnly you, once you turn it onGoogle holds the key by default, and a sync passphrase or on-device encryption puts the key in your hands instead.1, 4Turn it on
- History and open tabsOnly you, once you turn it onWith a passphrase Google can't read it, but Chrome then syncs only the addresses you type, not your full history.1Turn it on
- BookmarksOnly you, once you turn it onSealed once you set a sync passphrase.1Turn it on
- Who holds the keys
- Google holds the keys to your synced data, unless you set a sync passphrase that only you know.
- What Google can still see
- Without a passphrase, everything you sync, and Chrome history saved to Web & App Activity can shape Google's other products; a passphrase doesn't cover payment methods and addresses from Google Wallet.
Set a sync passphrase, once
- On your computer, open Chrome and sign in with your Google Account.
- Select More › Settings › You and Google, then select your account name.
- At the bottom, select Encryption options.
- Choose Use your own passphrase to encrypt all the Chrome data in your Google Account, enter it twice, then select Save.
Takes a minute. You'll need the passphrase on every device. To change or remove it later, Google deletes the locked data from its servers, so export your passwords first. With a passphrase, Chrome syncs only the addresses you type, not your full history.
Email is worth checking next: Gmail, Outlook and iCloud Mail can all read your mailbox. See which email services can.
Is Chrome sync end-to-end encrypted?
Not by default. Google says your synced data is always encrypted, but only a sync passphrase lets you keep it in Google's cloud without Google being able to read it1. For passwords, Google says the key is stored in your Google Account, and Google uses it to unlock them4.
Google says a passphrase covers all the data Chrome syncs4, except payment methods and addresses from Google Wallet1.
Does Chrome use HTTPS by default?
Yes. In October 2026, Google turned on Chrome's Always Use Secure Connections setting for everyone2. Chrome tries a secure connection first and asks before it opens a public site that doesn't offer one2, 3.
Once you say yes, Chrome stays quiet about that site unless you haven't visited it for two weeks2. Local addresses, like your router's page, don't get the warning by default2, 3. You can turn the setting off3.
Can Google see my passwords in Chrome?
By default, yes. Google's help page says the key to your saved passwords is stored in your Google Account, and Google uses it to unlock them for you and to check them for leaks4.
With on-device encryption, you hold the key instead, and Google says no one but you can access your passwords4. You unlock them with your Google password or your phone's screen lock. Once it's on, it can't be turned off4.
What changes if I set a Chrome sync passphrase?
You need the passphrase on every new device, and Chrome syncs only the web addresses you type, not your full history1. You can't see your passwords at passwords.google.com, and your feed stops suggesting things based on the sites you visit1.
Changing the passphrase deletes the locked data from Google's servers and signs you out everywhere, so Google suggests exporting your passwords first1.
How Chrome compares
Sorted by how many parts are sealed by default, then by how many can be. Ties go A to Z.
Sources
- Get your bookmarks, passwords, and more on all your devices, Google. Read on 25 Oct 2026.
- Chrome Now Warns Before Insecure HTTP Connections, Google. Read on 25 Oct 2026.
- HTTPS by default, Google. Read on 25 Oct 2026.
- Get started with on-device encryption, Google. Read on 25 Oct 2026.
Changes to this answer
- First published.