A method of detecting unauthorized access to credentials of a credential store on a computing device, wherein one or more of the credentials are stored in encrypted form, the credentials being associated with a user of the computing device, the method comprising a keyring application running on the computing device: receiving from one requesting application of a plurality of potential requesting applications running on the computing device and that are different from the keyring application, a request for at least one credential of the credentials, at least one of said plurality of requesting applications being a browser application, and providing access to the at least one credential to the requesting application if the requesting application is authorized to retrieve the requested credential; monitoring access to credentials of the credential store within a time period associated with a first setting, wherein the time period is defined by a duration of an event, the duration of the event being one of: a time during which a window of a specified application remains open, a time during which a user is logged into an account of a specified service, a time during which an input device has not been user-actuated, a time during which an output device is in sleep mode, or a time during which a particular program is executing on the computing device; determining that a number of credentials accessed within the time period exceeds a threshold associated with a second setting; and outputting (540, 560), in a user interface to the user of the computing device, an indication of potential unauthorized access to the credential store responsive to determining that the number of credentials accessed within the time period exceeds the threshold. receiving from one requesting application of a plurality of potential requesting applications running on the computing device and that are different from the keyring application, a request for at least one credential of the credentials, at least one of said plurality of requesting applications being a browser application, and providing access to the at least one credential to the requesting application if the requesting application is authorized to retrieve the requested credential; monitoring access to credentials of the credential store within a time period associated with a first setting, wherein the time period is defined by a duration of an event, the duration of the event being one of: a time during which a window of a specified application remains open, a time during which a user is logged into an account of a specified service, a time during which an input device has not been user-actuated, a time during which an output device is in sleep mode, or a time during which a particular program is executing on the computing device; determining that a number of credentials accessed within the time period exceeds a threshold associated with a second setting; and outputting (540, 560), in a user interface to the user of the computing device, an indication of potential unauthorized access to the credential store responsive to determining that the number of credentials accessed within the time period exceeds the threshold.