Forced password update

[kare2k]

Note: Please do not post Personally Identifiable Information like email address, personal phone number, physical home address, product key etc.

Issue abstract: Norton forcing password change due to compromise

Detailed description: Two weeks ago I received a notice that I needed to “update your password now” because it had been compromised. Again today it is forcing the change, but what’s worse is there are instructions blocking the view of the password information! I cannot get rid of it so that I can actually see the information! What could be causing these so called “compromised” reasons? I use at least 16 digits, and it always shows some ridiculous amount of time before they could be compromised! Please, please advise! I cannot use my online banking account! Thank you.

Product & version number: Norton 360 Premium for 2026

OS details: Windows 11 Pro

What is the error message you are seeing?

If you have any supporting screenshots, please add them:

[bjm]

@kare2k

Two weeks ago I received a notice that I needed to “update your password now” because it had been compromised. Again today it is forcing the change, but what’s worse is there are instructions blocking the view of the password information! I cannot get rid of it so that I can actually see the information! What could be causing these so called “compromised” reasons? I use at least 16 digits, and it always shows some ridiculous amount of time before they could be compromised! Please, please advise! I cannot use my online banking account!

Hello @kare2k

That popup is a genuine feature built into the Norton Password Manager browser extension, but it behaves like an intrusive glitch.

The problem is that Norton overlays this aggressive alert directly over your bank’s login fields. When you try to click behind it or dismiss it, it either freezes, loops, or completely blocks the view of your original Bank of America login page.

Here is how to get around this banner right now and stop it from locking you out of your bank.

---

Step 1: Forcefully Dismiss or Bypass the Screen

Since the banner is breaking your browser view, do not try to click “Update password” inside that yellow box. Instead, use these steps to look around it:

• Click “Ask me later”: Tap the dropdown arrow next to “Ask me later” and see if it gives you an option like “Don’t ask again for this site” or “Remind me in 1 week.”
• Close the banner: Click the small “X” in the top right corner of the yellow header bar to dismiss the notification window entirely.
• Turn Off Autofill / Popups Temporarily:
  1. Click your Norton extension icon in your browser’s top toolbar.
  2. Open its Settings (usually a gear icon).
  3. Toggle off the feature labeled “Autofill” or “Show notifications on login pages”. This forces Norton to stop throwing screens over Bank of America so you can manually type your 16-digit password.

---

Step 2: Clear the “Compromised” Flag in Your Vault

Norton uses local, zero-knowledge scanning to check if passwords match known, publicly leaked dark web databases. If it gets stuck in a loop or falsely flags your strong password, you need to clear the alert directly from the dashboard:

1. Go straight to the official Norton Vault Website or click the extension button.
2. Open your full Dashboard view (not the pop-up).
3. Find your Bank of America entry.
4. Click Edit.
5. If the password is truly unique and you know it is safe, simply re-save the entry or slightly tweak the title/notes. Often, manually editing and saving the item inside the main vault settings forces the system to recalculate and clears the broken “compromised” warning status loop.

---

Why Your 16-Digit Password is Triggering This

As you correctly noted, a 16-digit password would take centuries to break using a standard guessing machine. However, Norton flags passwords based on leak matching, not guessability.

• The Password is Used Elsewhere: If you use this exact 16-digit string for your bank and any other website (even a random forum or utility app), and that other website had a data breach, the password is leaked. Norton spots that string on the dark web and assumes your bank account is in danger, even if the bank itself wasn’t hacked.
• The “Known Password” Glitch: Security systems check your password’s mathematical hash against a massive list of breached credentials. Occasionally, false positive matches happen, or a software update leaves the extension stuck in a continuous alert loop, failing to recognize that you already dealt with the warning weeks ago.

To clarify how this works, the Norton Password Manager app constantly scans known data breaches on the dark web. When it finds a password leak that matches the exact text string you use for your bankofamerica.com entry inside your vault, it triggers this specific popup notice right on top of your browser screen.

The problem is that the pop-up window is glitching, freezing, and layout instructions are physically blocking the underlying fields, making it impossible to see the password or finish logging into your banking account.

Here is how to get around this blocker immediately to access your money, and why it keeps happening to a 16-digit password.

---

How to Force Close the Blocker and Access BofA
Since the yellow box is aggressively hijacking your web page view, bypass it using these methods:

• Manually Close It: Click the small “X” icon in the very top right corner of that yellow banner to close the warning and unblock your view.
• Open the Web App Directly: Instead of using the browser extension popup, navigate directly to the standalone Norton Password Manager Web Portal in a completely different browser tab. Sign in there to view, copy, and read your banking login information clearly without any intrusive overlays.
• Temporarily Disable Autofill Popups:
  1. Click the Norton extension icon at the top of your web browser.
  2. Open the Settings menu.
  3. Turn off “Autofill” or “Show notifications on login pages”.
     This stops Norton from throwing that yellow box over the screen, allowing you to copy your password from the extension vault and manually paste it into the Bank of America Sign In Page.

---

Why Your 16-Digit Password is “Compromised”
It is incredibly frustrating when a robust, complex password gets flagged. However, Norton flags it based on historical leaks, not guessability.

1. The Password is Reused: If you use this exact same 16-digit password on any other website—such as a shopping site, a forum, or an old utility account—and that site suffered a data breach, hackers stole it. Because Norton sees that specific 16-digit string listed on a public dark web leak list, it assumes your bank account is vulnerable if it uses the same text.
2. A Past BofA Breach Notification: If Bank of America or a vendor associated with them had a credential leak in the past, the text was exposed.
3. Software Update Loop: Norton keeps forcing the change because its background database scan is stuck in an automated loop. Even if you checked it two weeks ago, the extension’s local memory hasn’t registered that you acknowledged the warning, so it keeps re-firing the alert every time you hit the page.

---

Clearing the Alert From Your Vault
Once you successfully log in to your bank, you can stop this recurring warning. Open your Norton Password Manager dashboard, open the Bank of America entry, click edit, and change the password to a brand new, unique 16-digit string that you have never used anywhere else. Re-saving the vault item with a fresh credential will clear the “compromised” status and stop the popup from appearing.

To help resolve the visual block, please tell me:

• Does clicking the “X” in the top right corner successfully clear the box away?
• If you log in using the official BofA mobile app on your phone instead of the computer browser, does it let you into your account normally?

Resolve compromised passwords with Norton Password Manager

1. How Norton Checks Your Bank Password
   According to the official documentation, Norton Password Manager constantly checks your saved website logins against Have I Been Pwned, a massive public database of global data leaks.

• To protect your privacy, Norton scrambles your password into a long code (a hash).
• It sends just the first five characters of that code to the database to see if there is a match.
• If a match is found, Norton assumes the password was leaked in a corporate hack somewhere and forces the Update Password notification onto your screen.

2. Why Your Strong 16-Digit Password is Flagged
   Even if it takes a computer centuries to guess your 16-digit password, length cannot protect it if it is swept up in a data breach.

• Shared Passwords: If you use those exact same 16 digits on any other website (like an old retail store, a forum, or a utility account) and that website was hacked, your password string is now public on the dark web. Norton sees it on the “leaked list” and flags it, even if Bank of America itself was never breached.
• The “First 5 Characters” Glitch: Because Norton only sends the first five characters of the password’s scrambled code to check for breaches, mathematical coincidences (called hash collisions) can happen. The app might be falsely matching your strong password with a completely different leaked password.

3. Why the Instructions Are Blocking Your View
   The documentation states that Norton is supposed to offer a “guided UI” (user interface) to walk you through changing the password.

The problem you are experiencing is a graphic layout glitch. Instead of sitting neatly off to the side, Norton’s “guided UI” box is stretching across your browser screen, freezing, and physically blocking Bank of America’s text fields. Because it is frozen, you cannot see the fields to type or use your account.

---

How to Get Rid of the Blocker Right Now
Since the guided flow is broken and locking you out of your banking page, you need to turn off the automated feature so you can log in normally.

1. Look at the top right corner of your internet browser and click the Norton Password Manager extension icon.
2. Click the Settings icon (the small gear shape).
3. Look for the feature toggles named “Autofill” or “Change Now / Guided UI Notifications” and turn them Off.
4. Refresh your Bank of America page.

Turning this off breaks the glitchy guided loop. The giant instruction block will disappear, allowing you to clearly see the Bank of America login fields so you can manually type your password and access your money.

AI sourced content may make mistakes
Caveat: Norton Password Manager is not my daily rider

[bjm]

@kare2k

Two weeks ago I received a notice that I needed to “update your password now” because it had been compromised. Again today it is forcing the change, but what’s worse is there are instructions blocking the view of the password information! I cannot get rid of it so that I can actually see the information! What could be causing these so called “compromised” reasons? I use at least 16 digits, and it always shows some ridiculous amount of time before they could be compromised! Please, please advise! I cannot use my online banking account!

Hello @kare2k

Step-by-Step Fix to Unblock Bank of America
Since you cannot interact with the fields hidden behind the frozen notice, you need to turn off the script that is forcing the overlay to appear.

Method A: Disable the Popup Interruption

1. Look at the top right corner of your internet browser (Chrome, Edge, or Firefox) and click the Norton Password Manager extension icon.
2. Unlock your vault if prompted.
3. Click on the Settings icon (the small gear shape) inside the mini-extension window.
4. Locate the feature toggles for Autofill or Show notifications on login pages and flip them to Off.
5. Refresh your Bank of America Sign In Page. The yellow box will disappear, exposing your login fields so you can manually type or paste your password.

Method B: Use the Independent Web Dashboard
If the browser extension is completely frozen or refusing to open settings, bypass it entirely:

1. Open a fresh browser tab and navigate directly to the standalone Norton Password Manager Web Portal.
2. Log into your account.
3. Find your Bank of America login block under your list of saved credentials.
4. Click the “eye” icon or edit button to display your 16-digit password cleanly on your screen without any formatting issues. Copy it manually to log into your bank.

---

Why Norton’s Internal Code Thinks It’s “Compromised”
It feels ridiculous for a 16-digit password to trigger safety alerts, but Norton’s system flags items based on a database lookup error, not cryptographic strength.

• The Local Cache Bug: Security extensions store background data logs locally on your machine. If Norton pushes an update, the local extension scanner can get stuck in a “memory loop”. It remembers an old security alert from weeks ago, but it fails to log that you already dismissed it. Every time the page reloads, the script panics, assumes a threat is active, and forces the window onto your screen.
• The Shared Password String Risk: If those 16 digits are completely unique to Bank of America, it is an extension bug. However, if those exact 16 digits have ever been used on another website that suffered a server leak, Norton sees the character string listed on a global dark web report. The software automatically flags it across every profile using that string—even your high-security banking profile.

To stop the recurring banner permanently once you get logged into your bank, go into your Norton Web Portal Dashboard, edit the Bank of America entry, use the built-in generator to swap it to a fresh unique password, and save it. This resets the scanning cache and clears the broken notice loop permanently.

Resolve compromised passwords with Norton Password Manager

1. How Norton Checks Your Bank Password
   According to the official documentation, Norton Password Manager constantly checks your saved website logins against Have I Been Pwned, a massive public database of global data leaks.

• To protect your privacy, Norton scrambles your password into a long code (a hash).
• It sends just the first five characters of that code to the database to see if there is a match.
• If a match is found, Norton assumes the password was leaked in a corporate hack somewhere and forces the Update Password notification onto your screen.

2. Why Your Strong 16-Digit Password is Flagged
   Even if it takes a computer centuries to guess your 16-digit password, length cannot protect it if it is swept up in a data breach.

• Shared Passwords: If you use those exact same 16 digits on any other website (like an old retail store, a forum, or a utility account) and that website was hacked, your password string is now public on the dark web. Norton sees it on the “leaked list” and flags it, even if Bank of America itself was never breached.
• The “First 5 Characters” Glitch: Because Norton only sends the first five characters of the password’s scrambled code to check for breaches, mathematical coincidences (called hash collisions) can happen. The app might be falsely matching your strong password with a completely different leaked password.

3. Why the Instructions Are Blocking Your View
   The documentation states that Norton is supposed to offer a “guided UI” (user interface) to walk you through changing the password.

The problem you are experiencing is a graphic layout glitch. Instead of sitting neatly off to the side, Norton’s “guided UI” box is stretching across your browser screen, freezing, and physically blocking Bank of America’s text fields. Because it is frozen, you cannot see the fields to type or use your account.

---

How to Get Rid of the Blocker Right Now
Since the guided flow is broken and locking you out of your banking page, you need to turn off the automated feature so you can log in normally.

1. Look at the top right corner of your internet browser and click the Norton Password Manager extension icon.
2. Click the Settings icon (the small gear shape).
3. Look for the feature toggles named “Autofill” or “Change Now / Guided UI Notifications” and turn them Off.
4. Refresh your Bank of America page.

Turning this off breaks the glitchy guided loop. The giant instruction block will disappear, allowing you to clearly see the Bank of America login fields so you can manually type your password and access your money.

AI sourced content may make mistakes
Caveat: Norton Password Manager is not my daily rider

[kare2k]

Thank you SO much for your reply, explanations and instructions. I dismissed the banner blocking my screen successfully and changed the password again. I could not find the features in the Norton extension icon settings to toggle off the Autofill or Show notifications on login pages. There was an option to “Always require vault password before filling a login or form”, which I always use on financial related sites. Please let me know if there is some other way to find that option if I need to.

I know when I started on my venture about assigning passwords, I repeated them on sites within sites and some are/were pretty simple. I have been changing them as I find them again. They’re basically insignificant, or they were back several years ago, but I’m aware they could probably cause problems if I don’t get them corrected.

I followed your instructions to clear the compromised flag in my vault. I changed the new password to 20 digits which gave it 2966 years supposed longevity. I never use financial passwords more than once, and always access thru the vault password lock and an authorization code, which is why I thought they were safe.

[bjm]

@kare2k

I could not find the features in the Norton extension icon settings to toggle off the Autofill or Show notifications on login pages.

Hello @kare2k
Sorry, they’re likely AI carry-over from prior NPM incarnations.
Norton Password Manager currently employs “click-to-fill”.

+++++++++++++++++++++++++++++++++++++++++++++++++

~ maybe, try:
Automatically show autofill suggestions when:
Interacting with site vs when: Site loads
Breached password warnings = “Off”

++++++++++++++++++++++++++++++++++++++++++++++++++

Norton Password Manager is strictly click-to-fill. Norton Password Manager does not automatically populate credentials the moment a page loads without you clicking the Norton icon or a prompt.

Norton Password Manager includes an “auto-fill” feature for logins, credit cards, and some forms, but it primarily works via click-to-fill . When you visit a saved site, a Norton icon (logo) appears in the username/password fields. You click it to select and fill credentials—it’s not fully automatic like some competitors that populate fields without interaction.

Norton Password Manager’s Chrome extension has minimal settings and no explicit “Autofill logins” or “Automatic login” toggle —auto-fill (Norton icon in fields for click-fill) activates by default once installed, logged in, and vault unlocked. It’s designed this way;

Norton Password Manager does not fill in your credentials automatically the moment a page loads without any action from you.

It uses a click-to-fill system. When you visit a login page:

1. A small Norton logo/icon appears inside the username and password fields.
2. You must click that icon (or a pop-up prompt) to select your account and trigger the filling process.

This is a deliberate security feature designed to prevent malicious websites from “grabbing” your credentials from hidden form fields without your knowledge.

Norton Password Manager is strictly click-to-fill. It does not automatically populate credentials the moment a page loads without you clicking the Norton icon or a prompt.

The “Edge vs. Chrome” phenomenon you’re seeing on the Norton Community is usually due to one of three things that make Edge feel like it has true autofill:

The “Native” Conflict (Most Likely)
Microsoft Edge has a very aggressive built-in password manager (Microsoft Wallet). If you haven’t fully disabled it, Edge may be filling the fields automatically before Norton even loads.

• In Edge: It often autofills “sans interaction” because the browser is doing it, not the Norton extension.
• In Chrome: Chrome’s sandboxing is stricter; if Norton is active, Chrome often steps back entirely, leaving you with only Norton’s “click-to-fill” icon.

Why the “click” is required on Mac/PC:
Web browsers on a computer are inherently less “locked down” than on mobile device. If Norton filled your password automatically the moment a page loaded (without a click), a malicious website could hide a transparent login box on a page and “steal” your credentials without you ever knowing. The click requirement on Mac and PC is a critical security layer that ensures you are the one authorizing the data transfer.

In Windows 11, Edge is integrated into the OS. It sometimes has deeper “Read & Write” permissions for form fields that allow the Norton icon to appear faster or more reliably than in Chrome, where the extension might “wake up” slower, forcing you to click the extension icon manually.

Summary Table

Feature	Norton (Chrome)	Norton (Edge)
Zero-Click Autofill	No	No (Unless Edge’s native manager is active)
Click-to-Fill (Icon)	Yes	Yes
In-Field Icons	Yes	Yes (Often more stable)

The bottom line: If your fields are filling with zero clicks in Edge, it’s almost certainly Edge’s built-in manager working in parallel with Norton. For security reasons (to prevent “invisible” credential theft), Norton requires that physical click on their logo.

Why the Confusion? “Autofill” vs. “Click-to-Fill”
The belief that Norton has “zero-click” autofill usually stems from a few specific technical and psychological factors.

The “Edge Assist” Illusion
This is the most common reason for the Edge vs. Chrome debate. Microsoft Edge has a built-in feature called Microsoft Wallet (formerly Edge Password Manager).

• The Scenario: If a user hasn’t fully disabled Edge’s native password manager, the browser itself fills the fields the moment the page loads.
• The Misconception: Because the Norton extension is also installed and visible, the user assumes it was Norton that did the work. In Chrome, the native manager is often more easily “pushed aside” by extensions, leaving the user with only Norton’s manual click-to-fill icon.

Marketing Terminology
Norton (and many other providers) uses the word “Autofill” as a broad marketing term for any feature that populates fields.

• Technical definition: Zero interaction required.
• Marketing definition: You don’t have to type your password. To a casual user, clicking a single icon to fill 10 fields feels “automatic,” so they describe it as “autofill” in forum posts, leading to confusion for those looking for a truly hands-off experience.

The Ghost of “Automatic Login”
Older versions of Norton’s software (back when it was called Norton Identity Safe) actually did have an “Automatic Login” feature. It would attempt to submit the login form immediately upon page load.

• Norton eventually moved away from this for security and compatibility reasons:
  • Security: To prevent “invisible” forms from stealing your data.
  • Compatibility: Modern websites with complex loading sequences (like React or Angular apps) often “break” if a manager tries to force data into fields before the page is fully ready.

Mobile System Integration
On iOS and Android, Norton integrates with the System Autofill API.

• When you tap a username field on your phone, a keyboard suggestion for “Norton” often appears.
• With Biometrics (FaceID/TouchID) enabled, the process is so fast—tap field, look at phone, fields filled—that it feels like zero-click autofill, even though an authentication step occurred.

---

Norton Password Manager intended behavior is “click-to-fill”. If a “field” fills without a click, it’s likely your browser’s native manager (Chrome or Edge) interfering with Norton Password Manager.

Caveat: Norton Password Manager is not my daily rider

[kare2k]

@bjm

~ maybe, try:
Automatically show autofill suggestions when:
Interacting with site vs when: Site loads
Breached password warnings = “Off”

Here’s my screenshot after turning on “Sign-in reminders”. I don’t see the settings for any other sites. Should I change the settings showing as active below?

I have read thru and followed most of your instructions. In Step 2 I generated a new password using 20 digits (2966 million years code) which can only be accessed from the vault with the password and an additional authorization code. I tweaked the notes. I use Firefox which is supposed to clear history/cache when I close. I never use financial or shopping sites passwords again, other than sites that tie their sub sites together.

Yesterday, the forced password change showed up again and I told it to remind me later.

I really appreciate your support and time given to this challenge. Thank you.

[bjm]

@kare2k

Yesterday, the forced password change showed up again and I told it to remind me later.

Were you able to disable/red Breached password warnings?

May be best – to document/report “issue” directly via Norton support.
Note: for an official Norton response – open a support case:
Norton Support Help Center → Contact us (bottom of page)
Contact Norton Support → Let’s get started | Welcome (signed in)

[kare2k]

@bjm Yes, I just disabled the Breached password warning! now I guess I need to wait to see if it appears again. Thank you SO much! Have a great rest of the week and weekend! Hopefully we won’t have to troubleshoot this any more!

P.S. I also disabled the save and update logins because it wants to update when I have additional verification info. Thank you.

[bjm]

@kare2k

Yes, I just disabled the Breached password warning! now I guess I need to wait to see if it appears again.

Hello @kare2k
Thanks for sharing your progress.

Caveat: Norton Password Manager is not my daily rider

[bjm]

Hello @kare2k
Care to share your progress.

[kare2k]

Hello @bjm , thanks for checking. So far, all is well and working. Thank you SO much for your help!