I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Question

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? Would it be a good idea to change my password or is that just being paranoid?

Answer 1

I highly doubt it.

• You didn't press enter but Google will sometimes send the information to quickly present your results. This is forced over HTTPS. Your information was likely encrypted and not exposed.
• According to most sources Google processes on average 3.5 billion searches per day. There is no additional information to prove your query is a password. Nor is there any public way for a person to get the search queries of a particular Google user. So they would have to be an actual employee of Google. The likelihood of a internal Google employee to trying your search queries as passwords to your account is highly unlikely. It might not even be possible for most standard Google employees to get such identifying information. But if so, the possibility of one with such access purposely targeting you is astronomical.
• Again, there is no additional context to prove it is your password. Nor is your user information submitted with your query. So in the event of a MITM attack where they can read your traffic I would still factor it as real low as they would also have to have your username.

I am going to flat out say there 99.9% chance you have nothing to worry about. If you are wearing a tin foil hat or still have a nervous tick then change your password. If you don't use this password elsewhere then you're golden since it isn't like they could log in with an old password. Otherwise I would move on and not worry about it.

Edit: @reirab made a point it could make it pop up in features that use your search history. I don't believe this happens if you don't press submit. But if you want to be sure clear your search history with Google. I can't be sure this clears it from Google's servers but it should prevent them from popping up in the auto-complete.

Answer 2

I recommend that you change your password. The fact is, that your password has been sent to their servers, even if you didn't press enter.

You can test that on your own, open your browser, Ctrl + Shift + I, select network, start typing and monitor traffic.

Here is an example, writing the keyword "test", and not pressing enter.

Pay attention to the letter q, which stand for search query: t, te, tes, test, as you can see this is almost the same thing as a keylogger.

Answer 3

It has been sent (encrypted) to Google. Change your password

It has probably been logged somewhere, along with many search terms and other junk people have typed there. While it's unlikely it will be used for anything you care or that endangers your account, why bear the risk? Simply changing it will solve it.

PS: I recommend using a browser search bar, with suggestions disabled.

Answer 4

Theoretically, you should change your password, as by typing it into google the password is sent to google.
Google does use https however, and I personally wouldn't be too worried about google having my password as a search, but hey, it's not ideal.
Realistically, I think you should be fine, but if you want complete security, it can't hurt to change your password.

Answer 5

It's doubtful, but consider the following

• The connection to Google Search is encrypted. As far as we know, Google Search History has not been compromised. In the event you have Google Search and Web History Enabled, your search history could theoretically be accessed by someone who managed to break into your account. You stated that you didn't press enter; it probably was never stored in your account if that's the case.
• In the event Google logs search suggestions before you hit enter it could theoretically be linked to your IP address and/or account if you were logged in at the time. If your account was court-ordered for information in a timely manner it might be possible for them to retrieve the information and test it against various accounts and/or to use against full disk-encryption. If this is a concern to you then I would change the password in question.
• If someone is actively attacking your wireless connection, has a false root SSL certificate installed on your computer, or using another MITM technique they might guess that it's a password and use it to aid further attacks.

In the end it depends on two factors: who your adversary is and how valuable the password is. If I were in your given situation I would probably just change my password to stay on the safe side.

Answer 6

Even though it was probably encrypted as others have stated, there's a risk that it may be displayed again as a suggested search if you were to type the same first few characters as part of a real Google search. If it was displayed again it may be at risk from shoulder surfers.

So I suggest you change your password.

Answer 7

I think you're asking the wrong question, and will suggest some edits.

Your question ("Because of autocomplete, is my password at risk?") implies you have a single password, and worries about the exposure threat from typing it into a search engine. You probably don't need to worry about that, but you do need to worry that one or more of the sites at which you've entered it has been breached.

These data leaks are common. They impact sites that simply store the password in plaintext (RockU springs to mind) to sites like Ashley Madison, which used a decent algorithm for storage, poorly implemented.

As such, if you have a single password you're using across many sites, it has probably been leaked in association with your email address.

I recommend using a password manager. I think 1Password is a good choice. I use inter-device sync to back up my vault, and I don't store even the encrypted passwords in the cloud.

Answer 8

Theoretically, yes, since your password has been sent to Google and is most likely stored somewhere along with billions of other short strings.

In practice though, the probability of that password getting out of that database and somehow making its way to an attacker that tries to use it to access your account is several orders of magnitude lower than many other mundane attacks you're constantly exposed to. So unless you're running a super high security system (something like a root DNS server or a root CA certificate), worrying about it would be irrational.

In fact, I'd say there's a good chance that the probability of something going goes wrong while changing your password and you ending up locked out or compromised anyway may be higher than the probability of you getting compromised from that.

Answer 9

It can't be possible (as far as I know PHP and MySQL). That's because PHP (a language in web development) tells MySQL (database server) to store your input after it's SUBMITTED.

And the auto-completion, I don't know much on it or what language is used to make that kind of feature, but I think it just gets what matches more with your string (i.e your password).

As there's actually no database of Google to store accidental passwords that haven't been submitted.

And even IF they (Google) get the password, they can't tell for which account, for what username. So, stop worrying.