I know Firefox 8 stores it's passwords in a SQLite database, which can easily be stolen with access to the HDD!

What about Thunderbird 8? How does it store the passwords and how can one retieve them?

I know NirSoft has this nice tool to retrieve passwords, but it's not compatible with Thunderbird > 5.

5 Answers 5


On linux, the password database is stored in:


See @Karrax's answer for Windows locations.

You can examine this file interactively using the sqlite3 CLI:

sqlite3 ~/.thunderbird/zxcv1357.default/signons.sqlite

sqlite> .tables
moz_disabledHosts  moz_logins
sqlite> .schema moz_logins
CREATE TABLE moz_logins (id                 INTEGER PRIMARY KEY,hostname           TEXT NOT NULL,httpRealm          TEXT,formSubmitURL      TEXT,usernameField      TEXT NOT NULL,passwordField      TEXT NOT NULL,encryptedUsername  TEXT NOT NULL,encryptedPassword  TEXT NOT NULL,guid               TEXT,encType            INTEGER, timeCreated INTEGER, timeLastUsed INTEGER, timePasswordChanged INTEGER, timesUsed INTEGER);
CREATE INDEX moz_logins_encType_index ON moz_logins(encType);
CREATE INDEX moz_logins_guid_index ON moz_logins(guid);
CREATE INDEX moz_logins_hostname_formSubmitURL_index ON moz_logins(hostname, formSubmitURL);
CREATE INDEX moz_logins_hostname_httpRealm_index ON moz_logins(hostname, httpRealm);
CREATE INDEX moz_logins_hostname_index ON moz_logins(hostname);
sqlite> select * from moz_logins;

If you wanted to fetch usernames/passwords from code, it's as simple as:

echo "select encryptedUsername, encryptedPassword from moz_logins;" | sqlite3 ~/.thunderbird/*.default/signons.sqlite

or the equivalent in your favorite programming language with sqlite3 bindings.

Of course, if they're encrypted (as shown above) you'll need to put some effort into guessing the master password used for encryption. As a user, know that if you use a weak master password (e.g. P4ssw0rd1) it will be trivial to get the cleartext passwords.

  • 2
    Any hints on decrypting the passwords, if you have the master password?
    – sfyn
    Commented Oct 19, 2014 at 18:37
  • I installed Thunderbird today on Ubuntu 14.04 and just out of curiosity checked the .sqlite files in the mentioned folder. Glad to know that Mozilla no longer saves passwords in this manner anymore. signons.sqlite doesn't exist anymore and moz_logins table couldn't be found in any of the tables. Hopefully, they are encrypting this information somewhere inside thunderbird! Commented Jan 21, 2016 at 19:10
  • 2
    @PrahladYeri now it is stored in logins.json
    – ZAB
    Commented Jun 10, 2016 at 9:55
  • @ZAB Yup, but the field says encryptedUsername and encryptedPassword, though I'm not so sure how strong (or weak) their encryption could be. Commented Jun 10, 2016 at 11:11
  • @PrahladYeri there is no encryption without a master password. The fields had the same name in signons.sqlite
    – ZAB
    Commented Jun 10, 2016 at 11:14

In Thunderbird 8.0, I can easily see all my passwords in the Options window, in Security tab, in the Passwords tab, in the Saved passwords window, with the "Show passwords" button.

I am not sure if you meant "how do I access the passwords programmatically".


The answer is yes.

ThunderBird stores all remembered email settings along with password into the SQLite database file 'signons.sqlite' in its profile location. The default profile location for different platforms is as follows,

[Windows XP]
C:\Documents and Settings\<user_name>\Application Data\Thunderbird\Profiles\<random_name>.default

[Windows Vista & Windows 7]

It would appear (since the docs for the master password relate to both) that Firefox and Thunderbird store their passwords in the same way. So yes, unless you encrypt your passwords with a master password, the passwords can easily be retrieved.


This Python script uses the Thunderbird/Firefox libraries to read the passwords stored in the logins.sqlite or signons.sqlite files from your profile folder.

It prompts you for your master password, which you can leave empty if you didn't use one.

And there is also this one, which I used recently (Oct. 2021) for Thunderbird passwords. It needs the logins.json and the key3.db or key4.db files from the profile directory. It also works for Firefox passwords.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .