I am wondering, assuming the latest version of Firefox, which of the following options would be more preferable security-wise (e.g. assess and/or password to user account will be stolen) and which one privacy-wise (exposing user to the least advertisement tracking etc.):

  1. Storing session cookies (i.e. logging in and never logging out), but not saving password & username in browser built-in Password Manager.
  2. Saving password & username in built-in Password Manager (without Master Password) and setting cookies and site data to be cleared when browser is closed.

P.S.: I am aware that using Master Password for password storage will increase security of the stored passwords. Though I am not wondering how to improve given options, but would like to asses them "as is".

  • 1
    Let us know what exactly you mean be secure.
    – mentallurg
    Commented Mar 29, 2020 at 19:52
  • 1
    This seems like a false dichotomy. Why did you pick those two arbitrary choices to consider? Commented Mar 29, 2020 at 20:09
  • On many sites, the session will expire after a period of inactivity. I'm not sure (1) would even work on those sites.
    – mti2935
    Commented Mar 30, 2020 at 10:40

2 Answers 2


There is a strong difference between both ways. Never logging out is only possible under 2 conditions:

  • you manage to keep the cookie in the browser client side - it may not be that easy because session cookies are normally non persistent ones
  • the server never expires the session - which would be a true security error (1)

or you maintain the session active by using a bot to regularly send requests - even there, a session remaining active for more than one day should light on red flags at the server security team

So IMHO being able to use it require that you willingly (or accidentaly..) lower the security level server side.

On the other hand, storing passwords client side still allow best security practices server side. It can even be advised to do so, because it allows to use strong passwords on the application. And cautious users could store them either in their browser with a master password, or even better in a good password manager like keypass.

TL/DR: you are right on one point: from a user point of view, having a long term session cookie or storing the password in the browser with no password password leads to the same poor security level. But the impact server side and globally on the organization recommended practices are quite different.

(1) Common practices are to kill an inactive session after few minutes (commonly 5 to 30 minutes)


I would argue that storing passwords in the browser is more secure than using cookies and staying logged in. But the best option over here would be to have your cookies deleted after every session and using a 3rd party password manager extension like lastpass with a strong master password for managing your login credentials.

You must log in to answer this question.