Plaid uses your login credentials to read your account, then disconnects
When you link a bank account through Plaid, you enter your username and password directly into Plaid's system—not into the app or website you're trying to connect. Plaid then logs into your bank on your behalf, reads your account information (transactions, balance, account type), and passes that data back to the app you're using. Plaid does not store your password after that login session ends.
The key difference from older methods: instead of you giving your password to a tax app or budgeting tool, you give it to Plaid, which acts as a middleman. Plaid handles the login, retrieves what the app needs, and disconnects. Your original app never sees your password at all.
This matters because many banks and financial institutions block third-party apps from accessing accounts directly. Plaid is one of the largest services that banks have agreed to work with, so it can log in where a random budgeting app cannot.
Key Takeaways
- You enter your bank password into Plaid's website or app, not into the third-party service you're trying to connect.
- Plaid logs into your bank, reads the data the app requested, and passes it back—then logs out and does not store your password.
- Banks recognize Plaid as a trusted partner, so they allow Plaid logins even when they block direct third-party access.
- You can revoke Plaid's access to your bank at any time through your bank's settings or through Plaid's own dashboard.
How Plaid actually reads your account information
Plaid's process works in steps. First, you choose your bank from Plaid's list and enter your credentials. Plaid then connects to your bank's website or API (a direct data connection that some larger banks offer). If your bank offers an API, Plaid uses that—it's faster and more secure. If not, Plaid logs in the way you would, using your username and password.
Once logged in, Plaid retrieves only what the app you're connecting to has asked for. A tax refund tracker might request your last 90 days of transactions and current balance. A loan application might ask for six months of history. Plaid does not grab everything—it pulls only what the third-party app needs.
After retrieving the data, Plaid sends it to the app you're using and ends the session. Your password is not saved in Plaid's database for future use. The next time you need to refresh your account data, you may have to log in again through Plaid, depending on how the app is configured.
Why banks allow Plaid but block other apps
Banks are cautious about third-party access because unauthorized apps can steal credentials or drain accounts. Plaid has agreements with most major U.S. banks and credit unions that allow Plaid to log in without triggering fraud alerts or blocks. These agreements exist because Plaid has security certifications, undergoes regular audits, and has built a track record over more than a decade.
When you try to connect a smaller or newer app directly to your bank, the bank's security system often blocks it as a potential threat. The bank does not recognize the app, so it assumes the login is fraudulent. Plaid bypasses this because the bank recognizes Plaid's login as legitimate.
Some larger banks (Chase, Bank of America, Wells Fargo) have also built their own APIs that apps can connect to directly, without Plaid. But most regional banks and credit unions do not have this infrastructure, so Plaid remains the standard way for apps to read accounts at those institutions.
What data Plaid can and cannot see
Plaid can see anything you see when you log into your bank online: transaction history, current balance, account type, routing number, and account number. It cannot see your password after the initial login, and it cannot initiate transfers or payments on your behalf unless you separately authorize that through the app you're using.
If you connect a checking account, Plaid sees checking transactions. If you connect a savings account, it sees savings transactions. If you connect a credit card, it sees the card's transactions and current balance. Plaid cannot see accounts you did not explicitly link—if you have three checking accounts at the same bank, Plaid only accesses the one you selected during setup.
The app you're connecting to may not see all of that data either. A tax refund tracker does not need your routing number, so Plaid may not pass it along. The app controls what it asks Plaid to retrieve, and Plaid only sends what was requested.
How to revoke Plaid's access to your bank
You can disconnect Plaid in two places: through the app you're using, or through your bank's settings. The fastest method is usually through the app. Most apps have a settings or connected accounts section where you can disconnect your bank. Clicking disconnect tells Plaid to stop accessing that account.
You can also revoke access directly through your bank's website. Log into your bank, find the settings for connected apps or third-party access (the exact location varies by bank), and look for Plaid or the specific app you want to disconnect. Removing it there stops Plaid from logging in, even if the app still has permission on its end.
Revoking access is immediate. Plaid cannot log in again unless you reconnect through the app. If you reconnect later, you will need to enter your password again.
Security concerns and what Plaid does to protect you
The main security risk with any password-based login is that Plaid's systems could be breached and passwords stolen. Plaid reduces this risk by not storing passwords long-term and by encrypting data in transit and at rest. Plaid is also SOC 2 Type II certified, meaning it has passed independent security audits, and it carries cyber liability insurance.
A secondary risk is that the app you're connecting to could misuse the data Plaid sends. Plaid cannot control what an app does with your transaction history once it receives it. You should only connect accounts to apps you trust. If an app seems suspicious or asks for more data than it needs, do not connect through it.
Plaid also cannot protect you if you enter your password into a fake Plaid page. If you are connecting through an app, make sure the app is legitimate before you proceed. Scammers sometimes create fake apps that look like real ones and capture passwords entered into fake Plaid login screens.
Alternatives if you do not want to use Plaid
Some apps offer other ways to connect your bank. Many larger banks have their own APIs or direct connections that apps can use instead of Plaid. If your bank is Chase, Bank of America, or Wells Fargo, check whether the app you want to use supports direct bank connection. You may be able to skip Plaid entirely.
Some apps also allow manual upload of bank statements or transaction exports. If you download a CSV or PDF from your bank, you can upload it to the app instead of linking your account live. This is slower and requires you to update manually, but it avoids giving any third party access to your login.
A few apps support read-only access tokens, a newer method where your bank generates a temporary code that the app can use instead of your password. This is more secure than password-based login, but it is not yet widely available. Ask the app whether it supports this method before you assume Plaid is your only option.
Frequently Asked Questions
Does Plaid store my password after I connect?
No. Plaid uses your password to log in once, retrieves the data the app requested, and then discards the password. It does not save passwords in its database. If you need to refresh your account data later, you may have to log in through Plaid again, depending on how the app is set up.
Can Plaid move money out of my account?
Plaid can only read data—it cannot initiate transfers or payments on its own. If an app you connected through Plaid asks you to authorize transfers separately, that is a different permission. Plaid itself has no ability to move money.
What happens if Plaid gets hacked?
If Plaid's systems were breached, the immediate risk would be to data Plaid currently holds—recent transaction history and account information. Because Plaid does not store passwords, hackers could not use stolen data to log into your bank. Your bank account itself would not be directly compromised, though the transaction data would be exposed.
Can I use Plaid with a credit union?
Most credit unions work with Plaid, but not all. Search for your credit union on Plaid's website to check. If your credit union is not listed, you may need to use manual upload or contact the app to see whether it supports other connection methods.
Why does the app keep asking me to reconnect through Plaid?
Some apps refresh your connection periodically for security reasons, or your bank may have ended Plaid's session after a period of inactivity. You will need to log in through Plaid again, but this is normal. If reconnection is happening very frequently, contact the app's support team.