On top of this keychain stores logins by domain. Even if an app is in a different developer’s container you can retrieve the credentials with just a couple taps.
I didn't know that, can they share logins across apps?
E.g. if I'm logged into Google Spreadsheets, am I also logged into Google Docs automatically?
Yes all apps by the same developer have a shared container.