Apple's iOS 26: New Security Features and Missed Opportunities

This week, Apple previewed its redesigned (and renumbered) operating systems at its annual Worldwide Developers Conference. While the new Liquid Glass design language was the star of the show across iOS 26, iPadOS 26, and macOS 26, there were some other standout features, like a vastly improved calling experience on the iPhone.

Apple also continued its annual tradition of introducing new privacy and security features in its latest operating systems, designed to keep you and your data safer than ever. Here are three of my favorite ones coming to the iPhone, iPad, and Mac—and three missed opportunities.

The Passwords app will now remember previous passwords

With iOS 18 and macOS 15 last year, Apple introduced the Passwords app—the one-stop app for managing all your passwords. The app was Apple’s first attempt at a standalone password manager, and it provided a robust set of management tools, including the ability to autocomplete 2FA codes, share passwords with family and friends, and even organize your passkeys.

In iOS 26, iPadOS 26, and macOS 26, Apple is adding a new feature to the Passwords app. It will allow you to see the previous passwords you’ve saved for any given website, along with the date you changed the password. It’s an especially useful feature for websites that require you to change your password periodically and do not allow you to reuse a previously used password. Now, you’ll be able to quickly glance at the past passwords you’ve used for the site and easily choose an alternate one.

Spam link protection in Messages stops you from clicking on a nefarious URL

While the iPhone, iPad, and Mac are among the gadgets with the best security protections built in, bad actors are becoming more clever in finding ways to exploit vulnerabilities in the operating systems they target. A common way these bad actors can infect your device with malware is by using a one-click attack. This is when the threat actor texts you a link, which you then click on. You may think this link is innocuous, but really the moment you clicked on it, it allowed the attacker to access data on your phone.

Bad actors know that many people will click on links that are texted to them, even from unknown senders. But now in iOS 26, iPadOS 26, and macOS 26, when the operating system suspects you’ve received a spam text, it will silo that text into a dedicated spam folder and convert the link to plain text—meaning it won’t be clickable.

You can still read the text and link in the spam folder, but the chances of you accidentally activating the link with a brush of your thumb are reduced. And if you decide the text isn’t spam and the link is safe, you can simply move the text to your regular message screen, where the link will once again be clickable.

FileVault encryption, enabled by default, keeps your data safe

For over two decades now, Macs have come with an optional extra layer of data security called FileVault. The technology encrypts your Mac’s storage so none of the data can be read on it unless the user’s password is entered first. This means that someone could steal your Mac’s storage, hook it up to another computer, and still not be able to get access to the data contained on it if they didn’t know your password.

Until now, FileVault has been something Mac users had to enable manually. But starting with macOS 26, FileVault will be enabled automatically for all users when they update to the new operating system. Turning on FileVault is something users should have been doing the entire time anyway, and it’s nice that Apple is finally making its activation default, as it will help secure the Mac’s data even in the unfortunate event that the computer is stolen and a bad actor has access to the drive.

Still . . . there are missed opportunities

While the three privacy and security enhancements noted above will make our iPhones, iPads, and Macs more secure and private than ever, it was disappointing to see that Apple didn’t add any other major privacy and security features this year. Some of the missed opportunities include:

• Lockable apps on Mac and Apple TV: Last year, Apple gave users the ability to restrict an app’s access on an iPhone or iPad behind Face ID or Touch ID. Before the app opens, you need to authenticate with your biometrics or PIN, ensuring that people who are using your phone or tablet can’t access data in apps you don’t want them to see. This kind of restricted app access would also be extremely useful on other devices we frequently share, such as our Macs and Apple TV.
• Limited calendar access: In past years, Apple introduced the ability to limit an app’s read access to just select photos in your photo library and select contacts in your address book. However, when it comes to calendars, you must either grant an app permission to access all of your calendar data, allow it to only add calendar entries, or deny all access. Still missing is the granular control to give an app read/write access to only select calendars, such as your work calendar, but not your personal one.
• Lockable folders: Many of us share our Macs with family members or work colleagues. A privacy and security feature Mac users have hoped for for years, which is still conspicuously absent, is the ability to lock individual folders in macOS’s Finder behind Touch ID or a password. This would prevent someone with access to your user account (say, your child) from reading—or accidentally deleting—important or sensitive documents (such as your health records).

Yet despite these misses, this year’s software releases show Apple is still working to actively increase privacy and security for users across its devices. The passwords, spam link, and FileVault improvements will be available when Apple rolls out its software updates to all users in September.

FAST COMPANY