After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?


The password database isn't encrypted directly with your master password, instead a hash of the master password is computed and that hash is used to encrypt/decrypt the password database.

After you typed your master password, Firefox doesn't store the plaintext password anymore and instead simply use the hashed password to access the file.

  • After entering my password the following files changed: webappstore.sqlite, webappstore.sqlite-wal, sessionstore-backups/recovery.jsonlz4. I guess it is possible the hashed password is kept in one of those, or in RAM. Would you say the latter to be more secure (harder to access)? – Stockos May 23 '19 at 16:51
  • I think I understood wrongly. You say the hash is already in the file system, and that is used to decrypt the logins? If so, that doesn't seem to be secure at all... – Stockos May 23 '19 at 16:57
  • @Stockos if you set a master password, the password hash is not stored in the filesystem. It's recomputed everytime you open the password database. – Lie Ryan May 23 '19 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.