Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I log into Gmail/Facebook, my browser offers to save this password. Now, this login detail is stored in an SQLite file on my personal machine, which I can access.

The password entry though, happens to be encrypted and logically so. When I log into my favorite website, does the password that gets automatically filled a plain text password or an encrypted one? If it is plain text, what's the point of encrypting it if it can be decrypted easily? Shouldn't this just be a one way hash?

What is the mechanism of encrypting the passwords and how can we decrypt them, if at all we can.

share|improve this question

migrated from Aug 31 '12 at 13:31

This question came from our site for professional and enthusiast programmers.

1 Answer 1

Here's how google chrome does it. Looks like they use CryptProtectData on windows.

If you are allowing Mozilla FireFox or Thunderbird to remember passwords to web sites and/or email accounts in their Password Manager tool, you should know that these passwords are all stored in a plain text file (base64 encoded) on your computer’s disk drive. This file is accessible to anyone with administrative access to your computer. If you have any concerns about the possibility of other people accessing your computer and this gaining easy access to copies of the passwords that you are using, you really need to employ the “Master Password” feature of these programs.

get more about it from here

share|improve this answer
Are you sure it is a txt file for FF? I don't see any txt file. My system has a signons.sqlite file, the contents of which are (both) encrypted usernames and passwords. – n0nChun Aug 31 '12 at 6:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.