How to Recover Saved Passwords in Mozilla Firefox Browser (Step-by-Step Guide)

September 22, 2019

in Password Recovery, Password Secrets

1 Comment

4076

In this guide, you will learn where Firefox browser stores your saved passwords, how they are secured with strong encryption, and the easiest way to recover them instantly when needed.

Firefox Browser Password Secrets

Firefox browser & all its other variant browsers saves all your website login passwords at following location

[Firefox Browser]
C:\Users\[user_name]\AppData\Roaming\Mozilla\Firefox\Profiles\[random_name]\

[Firefox Beta Browser]
C:\Users\[user_name]\AppData\Roaming\Mozilla\Firefox\Profiles\[random_name-beta]\

[Firefox Developer Browser]
C:\Users\[user_name]\AppData\Roaming\Mozilla\Firefox\Profiles\[random_name-dev-edition]\

[Firefox Nightly Browser]
C:\Users\[user_name]\AppData\Roaming\Mozilla\Firefox\Profiles\[random_name]\

Older versions of Mozilla Firefox (prior to v32.0) stored all website login credentials in a SQLite database file named signons.sqlite within the profile folder.

This database contains a table called moz_logins, where each website’s login details are securely stored.

Below are some of the key fields available in this table,

id - index of each website entry
hostname - Website base URL 
formSubmitURL - Website Login page URL 
encryptedUsername - Encrypted username
encryptedPassword - Encrypted password

Firefox uses Triple DES and SHA-1 algorithm to encrypt both the username and password. The encrypted data is then stored in the file using Base64 encoding.

In newer versions (after v32.0), Firefox stores all website login credentials in a JSON file called logins.json.

Below are the key fields included for every credential entry,

{
"id":1,
"hostname":"https://accounts.google.com",
"formSubmitURL":"https://accounts.google.com",
"encryptedUsername":"MDIEEPgBBBBABBBEwFAYIbaZIhvcNAwcEaAFsqdqBAiJyHK56O9cid==",
"encryptedPassword":"MDoEEPgBCCCCAAAAAAEwFCDIKoZIBAtABCG4rNAexni08zRm4Sraz/",
},

To safeguard the secrets, Firefox uses the key that is derived from the Master Password. This key is then used to encrypt the username/password using SHA-1 and Triple DES encryption.

Firefox Master Password

Firefox allows you to set a Master Password to protect all your saved website credentials from unauthorized access. Once enabled, the stored passwords cannot be decrypted without providing this Master Password.

The “Master Password” itself is secured using a one-way hashing algorithm, meaning it cannot be directly decrypted. The only possible recovery method is through a brute-force attack, which can take a very long time depending on the password’s length and complexity.

Firefox stores Master Password–related data in the files key4.db and cert9.db, located in the same profile folder. Older versions used key3.db and cert8.db for this purpose.

Important Tip: Since Firefox does not use user-specific or machine-bound encryption, its passwords from other user account or external drive can be recovered using the software mentioned below.

How to Recover Firefox Browser Passwords Automatically

Recovering Firefox passwords manually can be complex and time-consuming due to multiple layers of encryption.

With XenArmor Browser Password Recovery Pro, you can instantly recover all Firefox passwords from every profile across all user accounts.

If a Master Password is set, you can simply provide it in the Settings to automatically recover all saved passwords.

Follow these simple steps: