Set up active password detection

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Enterprise Core, go to Menu  Chrome browserSettings.

3. (Optional) To apply the setting only to some users and enrolled browsers, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

4. Go to Chrome Safe Browsing.
5. Click Safe Browsing Protection:
   1. Configure safe browsing. For details, see Set Chrome policies for users or browsers.
   2. Click Save. Or, you might click Override for an organizational unit.

      To later restore the inherited value, click Inherit (or Unset for a group).

6. Click Safe Browsing allowed domains:
   1. Enter the URLs where users can reuse passwords.
   2. Click Save. Or, you might click Override for an organizational unit.

      To later restore the inherited value, click Inherit (or Unset for a group).

7. Click Disable bypassing Safe Browsing warnings:
   1. Choose whether to let users ignore warnings and proceed to malicious sites.
   2. Click Save. Or, you might click Override for an organizational unit.

      To later restore the inherited value, click Inherit (or Unset for a group).

8. Click Password alert:
   1. Choose an option:
      • Trigger on password reuse on phishing page—Password reuse is detected if users reuse their password on a phishing website that appears on the Safe Browsing blocklist.
      • Trigger on password reuse—Password reuse is detected if users reuse their password on a non-allowlisted website.
   2. For URL for password change, enter the URL where users can change their password.
   3. For Login URLs, enter the URLs where users usually enter their password to sign in to their account.
   4. Click Save. Or, you might click Override for an organizational unit.

      To later restore the inherited value, click Inherit (or Unset for a group).

Using Group Policy

In your Group Policy Management Editor (Computer or User Configuration folder):

1. Go to Policies  Administrative Templates  Google  Google Chrome.
2. Turn on Safe Browsing Protection Level.
   Tip: If you don’t see the policy, download the latest policy template.
   Leaving this policy Not configured uses the Unset behavior described above.
3. Set an option:
   • Safe Browsing is active in the standard mode
   • Safe Browsing is active in the enhanced mode
4. Enable Configure the list of domains on which Safe Browsing will not trigger warnings.
   Leaving this policy Not configured uses the Unset behavior described above.
5. Add the domains where users are allowed to reuse passwords.
6. Enable Password protection warning trigger.
   Leaving this policy Not configured uses the Unset behavior described above.
7. Set an option:
   • Password protection warning is triggered by password reuse—Password reuse is detected if users reuse their password on an unauthorized website.
   • Password protection warning is triggered by password reuse on phishing page—Password reuse is detected if users reuse their password on a website that appears on the Safe Browsing list.
8. Enable Configure the change password URL.
   Leaving this policy Not configured uses the Unset behavior described above.
9. Add the URL of the webpage where you want users to change their password.
10. Enable Configure the list of enterprise login URLs where password protection service should capture fingerprint of password.
    Leaving this policy Not configured uses the Unset behavior described above.
11. Add the URLs of the webpages where users usually sign in to Chrome browser. 
12. Deploy the update to your users.

• Set the <SafeBrowsingProtectionLevel> key to <integer>value</integer>, where <value> is 1 or 2.
• Add the domains for which you want to turn off Safe Browsing to the <SafeBrowsingAllowlistDomains> key.
• Set the <PasswordProtectionWarningTrigger> key to <integer>value</integer>, where <value> is 0, 1, or 2.
• Add the URL of the webpage where you want users to change their password to the <PasswordProtectionChangePasswordURL> key.
• Add the URLs of the webpages where users usually sign in to Chrome browser to the <PasswordProtectionLoginURLs> key. 

The example shows how to:

• Turn on Safe Browsing to help identify dangerous websites.
• Specify webpages where users usually enter their password.
• Allow domains that aren’t checked for password reuse.
• Detect password reuse on unauthorized websites.
• Set the webpage where users are prompted to change their password.

Using your preferred JSON file editor:

1. Go to your /etc/opt/chrome/policies/managed folder.
2. Create or update a JSON file.
3. Set SafeBrowsingProtectionLevel to 1 or 2.
4. Set PasswordProtectionWarningTrigger to 0, 1, or 2.
5. Enter URLs as needed. In:
   • PasswordProtectionChangePasswordURL, add the URL of the webpage where you want users to change their password.
   • PasswordProtectionLoginURLs, add the URLs of the webpages where users usually sign in to Chrome browser.
   • SafeBrowsingAllowlistDomains, add the domains for which you want to turn off Safe Browsing.
6. Deploy the update to your users. 

The example shows how to:

• Turn on Safe Browsing to help identify dangerous websites.
• Specify webpages where users usually enter their password.
• Allow domains that aren’t checked for password reuse.
• Detect password reuse on unauthorized websites.
• Set the webpage where users are prompted to change their password.

{
  "SafeBrowsingProtectionLevel": 1
}
{
  "PasswordProtectionWarningTrigger": 1
}
{
   "PasswordProtectionChangePasswordURL": "https://mydomain.com/change_password.html" 
}
{
    "PasswordProtectionLoginURLs": ["https://mydomain.com/login.html", "https://login.mydomain.com"]
}
{
    "SafeBrowsingAllowlistDomains": ["mydomain.com", "myuniversity.edu"]
}