After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?

1 Answer 1


The password database isn't encrypted directly with your master password, instead a hash of the master password is computed and that hash is used to encrypt/decrypt the password database.

After you typed your master password, Firefox doesn't store the plaintext password anymore and instead simply use the hashed password to access the file.

  • After entering my password the following files changed: webappstore.sqlite, webappstore.sqlite-wal, sessionstore-backups/recovery.jsonlz4. I guess it is possible the hashed password is kept in one of those, or in RAM. Would you say the latter to be more secure (harder to access)?
    – Stockos
    May 23, 2019 at 16:51
  • I think I understood wrongly. You say the hash is already in the file system, and that is used to decrypt the logins? If so, that doesn't seem to be secure at all...
    – Stockos
    May 23, 2019 at 16:57
  • @Stockos if you set a master password, the password hash is not stored in the filesystem. It's recomputed everytime you open the password database.
    – Lie Ryan
    May 23, 2019 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .