Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can the viruses access the passwords that have been saved by my browser?

  • 2
    The general answer is yes, you should assume they can.
    – Janis F
    Commented Jun 22, 2016 at 22:07
  • They are encrypted but this is not enoughly efficient.
    – Xavier59
    Commented Jun 22, 2016 at 22:10
  • 1
    If a program running on your user account can access some data (like Chrome can access your saved passwords), then in general so can any other program you run on your user account.
    – Macil
    Commented Jun 24, 2016 at 21:16

2 Answers 2


You should assume so no matter what*

When your system gets compromised you must assume that it has compromised any accounts stored on the system. You should go about changing the passwords for any accounts used on that computer in any place. You have no control over the virus, and you have no control how programs store your data so you don't know if your accounts are safe. As the general rule always assume a compromised computer means compromised accounts.

Password storage in browsers

For most browsers those passwords are stored encrypted, but since the computer is on and the infection has access to memory space it can find the key and decrypt them itself. These infections usually target the browsers specifically, but can also have a wider scope of impact.

The real attack the encrypted passwords protects against is the theft of the hard drive. However if the cipher text is in the memory then it can be found and taken.

Regarding Master Passwords and Password Managers

While convenient, these offer little protection from an infection due to the fact that the cipher text is still loaded into the memory space. These provide protection from sit down attacks, stolen hard drives, and user ineptitude.
They do not protect against an infection that has access to memory space

*: unless you know absolutely how and what and where the infections do their work.

  • 1
    I'm actually worried about an account for which it's impossible to change the password, so it only matters if they steal the password. Can they steal the password itself?
    – Jeff Caros
    Commented Jun 22, 2016 at 22:15
  • 3
    Yes. If the browser can decrypt the password, so can the virus because at some point the cipher text must be in the memory or storage and the virus can find it. This is why Chrome doesn't bother with a master password. Commented Jun 22, 2016 at 22:17
  • 1
    Yes but how many viruses do you notice? Commented Jun 23, 2016 at 1:28
  • 1
    And honestly that is semantics. It's when the key is loaded into the memory regardless of mode master password that you are compromised. Commented Jun 23, 2016 at 1:32

There are methods of stealing browser-saved passwords so you need to assume that your browser is always vulnerable.

At a very minimum, you should set a browser master password and enable encryption to stored passwords. You can also look into using something like KeePass which allows you to store encrypted passwords where you choose (i.e. hard drives, portable drives, and network drives, etc).

Google Chrome, on it's own, is not designed to be very secure. LastPass is another half way decent option for securing browser passwords. LastPass gives you an added layer of protection as you need a master-password to start using it every time. And one of the most important aspects of using LastPass would be that it doesn't show the saved passwords on websites as it is unless and until you initiate LastPass, unlike password keeper.

This may lead to someone changing the form text box type to 'text' to view the contents in your saved password. This can be done using the inspect element feature of your browser.

  • 2
    There's some good information here, but the truth of the matter is it's when the cipher is in memory and the passwords are being decrypted that the cipher is copied. A master password only offers just as much security here as encrypting it in the first place because no matter what you must load a cipher to decrypt the passwords. Password managers are prone to the exact same problem. What a password manager protects against is a sit down threat/stolen HDD. Not a virus. Commented Jun 23, 2016 at 17:37
  • What you say is true. This is why in my answer I said, "At a minimum". A little security is always better than none. Commented Jun 24, 2016 at 18:35
  • 1
    It's only changing the cipher text, and probably to something easier to brute force than the one generated for you by Firefox in the first place. This is why the first step to having secure accounts is having a secure password in the first place. The master password really only adds convenience. Firefox encrypts the data by default like Chrome so I'm not sure you gain anything here with one at all other then a false sense of security? google chrome's head of security said it best in an easily googled quote. Commented Jun 24, 2016 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .