I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of password on its database and does not know the encryption keys. So now my question is how the Sync actually works then!!! I mean how can I view my passwords on android device for example? To make my question more general, I want to know the work flow of such apps and password manager which claim to preserve privacy while protecting your data and more interestingly working on multiple platforms

  • Google most likely stores your passwords encrypted, but they hold the key and could decrypt your passwords. This can be seen as your passwords are not lost when you need to reset your google password. Other services like Bitwarden encrypt your passwords with a key derived from your account password. The passwords are encrypted locally (ie. your encryption key is never sent to the service) and the encrypted passwords are stored online. When you login from another device you retrive the encrypted passwords and decrypt them locally with your account password. Google has no such security features.
    – Gamer2015
    Mar 6 at 11:58
  • Zero-access file sharing services (like sync.com) enable users to share files between multiple devices, without the service provider having access to the plaintext of these files. It would seem that the same methodology could be used to share passwords between devices. See sync.com/pdf/sync-privacy-whitepaper.pdf for more information on how sync.com implements zero-access file sharing.
    – mti2935
    Mar 6 at 12:35

2 Answers 2


There is a question of trust here. The common way for password synchronization is to have the element that receives the password change request to broadcast (using secure channels...) the new password to all other elements. Then each element is responsable for the way it stores the password in long time storage, either in plain text (or using a reversible encryption as obfuscation) if the user must be able to see it, or in an non invertible hash if all what is wanted is to be able to later validate the password. The former way is normally only used on client devices (here your android device), the latter should always be used server side (here on Google servers).

But to be able to synchronize passwords, the password has to be exchanged in plain text (or with a reversible encryption). You just trust the server for not storing it in that form...

  • So in this article and specifically in how we protect your data part it is telling a lie? Because I noticed that although my all other devices are off and not connected to the internet. When I log in to my Google account, I can use all my passwords there! It means that the passwords are stored in an irreversible way on Google and Google exactly knows the key to decrypt them!
    – John
    Mar 6 at 11:56
  • 1
    The article only discusses how google checks if your passwords have been leaked. This is easier than storing your passwords in an end2end-encrypted way. The decryption key for your google password is most likely stored in a secure place in google, where only privilleged servives (or people) have access to. Checking whether your passwords have been compromised can be done without google having to decrypt your passwords by obfuscating it locally and then sending it to google. (eg. by hashing it)
    – Gamer2015
    Mar 6 at 12:08
  • 1
    You seem to mix different points. The post linked in you question was about how Chrome stores the password locally, and the answer is that in the end, they are encrypted and can be decrypted by using your Windows session password. That is done under the hood by a Windows API function. This article linked in your comment is about how Chrome can compare your credentials with a list of leaked credentials and that part actually only exchanges hashes so for that feature Google never knows your password. But your question seemed to be about synchronization and my answer is only about that point. Mar 6 at 12:17
  • @SergeBallesta Yes I understood but it seems a little bit pointless if you have the decryption key! you could easily compare plain texts of passwords! the final point I could make is that all your passwords are in danger of compromise if somehow there is a breach in Google and they can get the encryption passwords of users!
    – John
    Mar 6 at 16:20
  • @JohnM. : the fact is that Chrome has to be able to access the passwords. If there is a breach in Chrome, all the passwords registered there can be compromissed. But Google never stores that on their servers - at least they promise they do not. And they explain that they do not use the plain text credentials to compare to a leaked list, because they only use non invertible hashes there. Mar 6 at 18:12

One way to sync a password from device a to device b, without the service provider having knowledge of the password, would be as follows:

  1. Client program on device a retrieves the encrypted password from its local database, and decrypts the password using a function akin to CryptUnprotectData().

  2. Plaintext password is transferred from client program on device a to client program on device b, through service provider, without service provider having knowledge of the plaintext password, using a methodology similar to that used by sync.com.

  3. Client program on device b encrypts the password using a function akin to CryptProtectData(), and stores the encrypted password in its local database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.