People lock a Chrome profile to hide history. The thing actually worth guarding is the password vault inside it. This page shows what protects that vault today, where the honest gap is, and the three habits that close it.
Open chrome://settings/passwords on your own PC and look at the list for a moment. That is not a settings page — it is every account you own, in one scroll. This page is about protecting that list properly: what Chrome already does, what it does not do, and why the profile lock from the video earns its keep precisely here.
Bookmarks are embarrassing at worst. Saved passwords are money. A Chrome profile usually holds the keys to email — and email resets everything else — plus banking, shopping and office accounts. Whoever opens your profile does not need to read a single password to misuse them: they open a site, Chrome fills the login, and they are in.
That is why every lock in this set exists. The extension lock on your profile is, in practice, a lock on your password vault — judge it by that standard.
Chrome has one honest protection of its own here. In current versions, when you try to view, copy or export a saved password in the Password Manager, Chrome asks for your Windows account password or PIN first. A stranger who opens your profile cannot simply read the list out loud or download it — unless they also know your Windows login.
Chrome can also use Windows Hello — fingerprint, face or PIN — to approve filling passwords, which you can switch on in the Password Manager settings. Turn it on: it makes every autofill a small act of proof that the person at the keyboard is you.
The gate above guards the vault door, not the shopping. Ordinary autofill still signs you — or whoever is sitting there — into sites silently. That is the convenience Chrome is built around, and it is exactly the hole an unlocked profile leaves open.
If sync is on, your passwords also live in your Google account, viewable at passwords.google.com after a Google sign-in. That is good resilience and one more reason the lock that matters most is the Google account itself: strong password, two-step verification on. A local profile lock cannot protect the cloud copy — only the account password can.
The full profile lock setup on screen — extension install, password set and the live test.
▶️ Watch Full VideoThey can open the Password Manager screen, but current Chrome asks for your Windows password or PIN before showing, copying or exporting any individual password. The bigger risk is autofill: saved logins will still fill in on websites without showing the password itself.
On your own, account-locked PC, it is a reasonable convenience. On a shared PC, no — do not save banking or primary email passwords in a profile other people can open. Those two accounts deserve to be typed, every time.
It writes every saved login — site, username and password — into one plain text file. It exists for moving to a password manager. Treat creating it like printing all your keys: do it privately, move the file where it belongs, and delete every copy afterwards.