Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a fear-driven reaction to recent hacking events I thought over my password strategy. The basic question is are my saved passwords in FireFox safe from remote access?

I.e. where are they kept, are they kept in plain text, are there known vulnerabilities.

I run OS X 10.6 & Windows 7.

share|improve this question
up vote 6 down vote accepted

Firefox keeps your passwords in your profile, and in most/all versions since v2.0 this data is encrypted.

Check out here: for locations of the password files on Windows (various versions), Linux and Mac.

  • key3.db - Key database
  • signons.txt - Previous to - Encrypted saved passwords, requires key3.db to work
  • signons2.txt - and above - Encrypted saved passwords (and URL exceptions where "NEVER SAVE PASSWORD" is selected), requires key3.db to work
  • signons3.txt - 3.0 and above - Encrypted saved passwords (and URL exceptions where "NEVER SAVE PASSWORD" is selected), requires key3.db to work
  • signons.sqlite - 3.5 and above - Encrypted saved passwords (and URL exceptions where "NEVER SAVE PASSWORD" is selected), requires key3.db to work.
share|improve this answer
But what kind of encryption does Firefox use? I can find no Mozilla web page that makes this clear. They just say "encrypted" which is less than informative. – rlandster May 20 '12 at 7:20

From Firefox Help - Recovering important data from an old profile:

Your passwords are stored in two different files, both of which are required:

  • key3.db - This file stores your key database for your passwords. To transfer saved passwords, you must copy this file along with the following file.
  • signons.sqlite - Saved passwords.

Thus, I would try searching your computer for these two files and checking them out for yourself...

share|improve this answer
I wouldn't trust it though. My friend installed Chrome and it was able to copy his passwords over. If Chrome can do it, viruses can. – tjameson Apr 5 '11 at 17:51
He didn't use encryption in that case. If he did, this wouldn't work. – Henno Apr 5 '11 at 17:55
If the OP encrypted these files, he would be safe... – studiohack Apr 5 '11 at 17:59
tjameson suggests that since Chrome can copy the passwords they are not safe. This isn't necessarily so. The passwords are encrypted using the master password. Chrome can copy the files containing the encrypted password, and it can decrypt them if it has the master password. It knows how to decrypt them because the method of encryption is public. It's the key (the master password) that keeps things safe. So the reason Chrome was able to decrypt the file was that the user supplied the master password. – Wayne Johnston Apr 6 '11 at 1:31

password forensics has an overview and tools for recovery. The latter is a brute force attack on the master password (if you have it, which you should). The security is as good as your password, basically. This link has more details (same site).

share|improve this answer

"...Firefox does encrypt the passwords you ask it to remember..." Source

But it's also important to note that anyone who has access to your computer can easily access all of your remembered passwords.

Tools -> Options -> Security tab -> Saved Passwords -> Show Passwords

This list will be filled with all of your remembered usernames and passwords, as well as the site they go to

share|improve this answer
My friend had a master password set, but that wasn't enough to stop Chrome from copying the passwords over. I wouldn't trust the security of it. Any virus that knows how to make SQLite queries can recover data. – tjameson Apr 5 '11 at 17:57
Firefox does encrypt the passwords if you use a master password. See…. – Wayne Johnston Apr 6 '11 at 1:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .