Web browsers store credentials in local databases, the level of protection of which varies depending on the OS and configuration. Retrieving saved passwords requires knowing where each system keeps them, as well as understanding the security limitations of these locations.
Storing passwords in browsers: what local encryption really protects
Chrome, Firefox, and Edge encrypt saved passwords using the operating system’s cryptographic APIs. On Windows, Chrome relies on DPAPI (Data Protection API), which ties decryption to the active user session. In practical terms, any process running in your Windows session can access passwords in plain text.
Firefox stands out by allowing users to set a master password that adds a layer of encryption independent of the OS session. Without this option enabled, the logins.json file remains readable by any software with user rights.
The CNIL now considers that storing passwords in a browser without a master password is a bad practice. Its recommendations on authentication advocate for a dedicated password manager, with storage in the form of cryptographic hashes using modern algorithms like Argon2, scrypt, bcrypt, or PBKDF2. This official stance contrasts with the permissive approach of most online tutorials.
We recommend checking the list of passwords on CGI Network to precisely identify where your credentials are stored based on your configuration.
Finding your saved passwords on Chrome, Firefox, and Edge
Google Chrome and the Google Password Manager
Open Chrome, then go to Settings, select the Autofill and passwords section, then Google Password Manager. The complete list of your credentials appears, sorted by site. To view a password, click on the eye icon: the system will ask for your PIN, fingerprint, or Windows password.
On Android, the path goes through Device Settings, then Google, then Password Manager. The credentials synced via your Google account are grouped there.
Firefox: the Credentials and Passwords menu
Go to Settings, Privacy & Security section, then Credentials and Passwords. Firefox displays each entry with the username and a button to reveal the password. If you have enabled the master password, it will be required before any viewing.
Microsoft Edge
Edge uses the same engine as Chrome (Chromium) and stores passwords similarly. Go to Settings, Profiles, then Passwords. Identity verification is done through Windows Hello or the Windows account password.
Exporting and migrating passwords without a plain text CSV file
CSV export remains the most common method for extracting credentials from a browser. The problem: a CSV file contains all your passwords in plain text, without any encryption. A forgotten deletion, an automatic cloud backup, and this file becomes a vector for compromise.
The Google Password Manager now offers import and export options that incorporate the Credential Exchange protocol. This mechanism allows you to transfer passwords and passkeys to another manager without generating an intermediate plain text file, significantly reducing the attack surface during migration.
If you must use a CSV, apply these precautions:
- Encrypt the file immediately after export (7-Zip with AES-256 or GPG) and delete the unencrypted version
- Disable cloud synchronization of the folder containing the file to prevent it from being uploaded to Google Drive, OneDrive, or iCloud
- Import into the target manager right away, then destroy the encrypted file with a secure deletion tool
Dedicated manager or browser: technical choice criteria
A dedicated password manager (KeePass, Bitwarden, Proton Pass) offers an end-to-end encrypted vault with a mandatory master password. The browser, on the other hand, delegates protection to the OS. The difference is not trivial: an infostealer malware extracts Chrome passwords in seconds as soon as it gains user rights.
Dedicated managers store data in a proprietary encrypted format, often with a zero-knowledge architecture. The provider itself cannot read your credentials. Proton Pass, for example, avoids the Cloud Act by hosting its servers in Switzerland, a point that matters to users concerned about jurisdiction.
We observe that the choice rarely boils down to a matter of convenience. The discriminating criteria are:
- The presence of a published and verifiable independent security audit
- Support for passkeys (FIDO2/WebAuthn) in addition to traditional passwords
- The ability to share a credential without revealing the password in plain text to the recipient
- Interoperability with two-factor authentication systems (TOTP, physical keys)
Passkeys and the future of passwordless authentication
Passkeys are gradually replacing traditional passwords with a public/private key pair. The private key remains on the device, protected by biometrics or the unlock code. No shared secret travels over the network, eliminating phishing through credential interception.
Google, Apple, and Microsoft natively integrate passkeys into their respective managers. Passkey synchronization between devices works via the provider’s cloud account, raising the same trust issues as with traditional passwords.
For accounts that do not yet support passkeys, two-factor authentication via TOTP app (and not SMS, which is vulnerable to SIM swapping) remains the most reliable complement to a strong password stored in a dedicated manager.
The browser’s password manager remains an acceptable troubleshooting tool for non-sensitive personal use. For everything else, migrating to a dedicated vault and enabling passkeys where offered constitutes the strongest combination to date.