Keeping passwords/credentials out of the cloud Under what circumstances will a current Android sync or otherwise send passwords off the device? The credentials in question are for:


WiFI
Non-Gmail email accounts accessed through the stock Gmail app
Other apps, eg. Twitter


This question is on behalf of a family member looking at acquiring a Pixel 3, but concerned over how such is handled (including whether apps are able to read each other's data). I've been able to find details of how the Gmail app works with credentials for Gmail accounts, but for other email types and the other cases the details seem more fuzzy (or the answers more than five years old).

It is of course expected that for email protocols such as POP3 the client will need to submit the credentials off the device to authenticate with the service; this question is about whether they might get sent somewhere else as well, for whatever reason, and whether this can be controlled.
The Wifi credentials are automatically synced to the Google Cloud if you have enabled the setting "Backup to Google Drive" (Android settings).

Regarding the credentials (e.g. username and password) used by other apps there is no way to say something in general. Those apps may or may not store the required credentials in a secure way. Modern Android systems (Android 5 and newer) provide some relative secure mechanisms for using encryption keys that are maintained by Android itself. Those keys can then be used for encrypting the credentials before saving them to the flash memory. But using encryption the correct and secure way isn't easy. A lot of app developers use the easy and sloppy way and store credentials more or less in plain text.

Also the automatic backup into the cloud comes into play - if the app developer has not configured it correctly the stored credentials are backuped/synced into the Google cloud (if enabled system-wide, see first section).

Last but not least the is your question about the possibility to detect if an app sends credentials into the net. Unfortunately the only answer is: If the app developer wants to do so the app can do it. Additionally this can also be done by any development library the developer includes into the app (advertising, tracking, ...).