Two considerations here: 1. Is the password private info that the employer shouldn't access? 2. If it is private but someone sees it anyway, should they act on

Two considerations here: 1. Is the password private info that the employer shouldn't access? 2. If it is private but someone sees it anyway, should they act on it? For (1): This is similar to any other private info stored on company equipment. The employer shouldn't actively access it in most cases, but it is generally expected that the employer will access if it has a good reason (in this case, detecting a weak password is a good reason). For (2): This is similar to accidentally overhearing someone's private conversation. Normally the polite thing is to stop listening, but if you have reason to believe it indicates harmful behaviour (like in this case), the right thing to do is to report it.