Here I'm entering credentials for OneDrive:

remember my password

If I check Remember my credentials, I assume that malicious code running as my user account can get access to some token and use that to interact with OneDrive as if they were me.

My question is, what beyond that can malicious code (running as my user account) do with the "remembered" credentials?

  • Can they be used to authenticate as my user for services other than OneDrive?
  • Can they be used from another PC?
  • Do they ever expire?
  • Can they be copied elsewhere to perform an offline brute-force attack to get the original credentials?

1 Answer 1


I assume what is remembered is the OAuth2 refresh token.

In this case,

  • no, it can't be used for other services.
  • yes, it can be used from another PC. From the server side, it's no difference. Maybe a different IP, but that could be your "first" computer too
  • this token is valid for at least 6 month in Onedrive (https://github.com/OneDrive/onedrive-api-docs/issues/124) (altough changing your password invalidates it immediately)
  • no, the token alone, without server access, isn't related to login name and password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .