# Where your saved passwords are, and who else can open them

> If you have ever clicked «Save password», you already use a password manager. The interesting question is not where your passwords live, but what it takes to open them: and there Chrome, Safari and Firefox are nothing alike.

2026-08-30 · David Carrero · password.es
Original: https://password.es/en/blog/where-your-saved-passwords-are/

---

If you ever clicked «Save password» in that little window at the bottom of the
screen, you already use a password manager. **Nobody told you, you never chose
one, and you have one anyway.** Probably with a hundred entries in it.

That explains why the most repeated question about passwords is not «how do I
make a good one», but «where are mine». People are not looking for a security
manual: they are looking for a list they know exists and cannot find.

The list exists. But where it is stored matters far less than the answer to the
next question, the one almost nobody asks: **what does it take to open it?**

## Where they are, depending on what you use

In **Chrome** they are in Google's password manager. They live in two places at
once: a copy on your computer and another in your Google Account, kept in sync.
You can see them at `passwords.google.com` or in the browser's own settings.

On **Safari, iPhone and Mac** they are in the iCloud Keychain, which recently got
an app of its own, Passwords. Same idea: on the device and in your Apple Account.

In **Firefox** they are in two files inside your profile, and the names are worth
knowing: `logins.json`, which holds your usernames and passwords encrypted, and
`key4.db`, which holds the key that decrypts them. Mozilla documents it exactly
like that, with those names.

In **Edge** they are in your Microsoft account, on the same scheme as Chrome. And
on **Android** it is the same Google manager Chrome uses, even if you open it
from the phone's settings.

That is the answer you came for. Now the part that changes something.

## Three models, and why they are not equivalent

All of them say «your passwords are encrypted». It is true in all three cases and
it does not mean the same thing in any of them, because what changes is **who
holds the key**.

**Apple's keychain is end-to-end encrypted.** The keys that open it are not known
to Apple; they exist only on your trusted devices. Apple publishes this in its
security documentation, and adds a welcome detail: the system rate-limits
attempts, precisely so that not even from inside its own infrastructure can
anyone sit there guessing. There is nothing to switch on. It is already like
that.

**On Google, that mode exists but is optional.** By default your passwords travel
encrypted and are stored encrypted, but with keys Google manages. You can change
it: a *sync passphrase* —or on-device encryption, depending on where you go in
from— leaves the keys in your hands only. The practical difference is enormous
and most people have never turned it on, because nobody told them it was there.
It has a price, and the price has to be stated in full: **if you forget that
passphrase, nobody recovers your saved passwords.** That is exactly what «only
you» means.

**In Firefox, without a primary password, encryption does not protect you from
whoever has your files.** This is the most uncomfortable part of this article,
and it comes from Mozilla, not from us: without a primary password set, anyone
who copies `logins.json` and `key4.db` out of your profile can read your
credentials. The two files travel together: one carries the lock, the other the
key. Setting a primary password is what encrypts that key and breaks the pair.

## The real scenario is not a movie

When people imagine their passwords being stolen, they imagine someone attacking
servers. In practice the two cases that happen are far more domestic.

The first: **someone with access to your unlocked computer.** No skill required.
The list is two clicks away in the browser settings, and even if it asks for your
system password to reveal them, that password is known to whoever lives with you
or has watched you type it.

The second: **a program that copies your browser profile.** It breaks nothing. It
takes the files and opens them somewhere else, at leisure. That kind of software
is common enough to have its own industry name, *infostealer*, and it is the
exact reason why «but they are encrypted» always needs the follow-up question:
encrypted, sure — and where is the key?

Against that second scenario, Apple's model holds, Google's holds if you turned
the passphrase on, and Firefox without a primary password holds nothing.

## What to do, in order of how much it changes

**One.** If you use Firefox, set a primary password. It is a checkbox in the
privacy settings and it is, by a distance, the change on this list that protects
the most for the least effort.

**Two.** If you use Chrome or Android, go into Google's manager and turn on
on-device encryption or the sync passphrase. Write it down somewhere physical
before you switch it on, and understand what you are signing: from that moment,
that phrase is the only door.

**Three.** Look at the password of the account that holds everything else. Your
Google Account, your Apple ID or your Microsoft account stopped being «one more
account» the moment you started saving passwords inside them: they are now the
key to the rest. If you invented that password yourself eight years ago, run it
through the [checker](/en/checker/) and see what it says. And if you feel the
urge, replace it with one from the [generator](/en/).

**Four.** Turn on the second factor for that account. That is the step that turns
«they know your password» into «they still do not get in».

## Is this enough, or do I need a real manager?

It depends what for, and here the honest answer is not the one that sells.

For most people, the browser's manager with encryption properly configured **is
enough**, and it is infinitely better than the real alternative, which is not a
better manager: it is the same password repeated across forty sites.

A dedicated manager wins when things show up that the browser's does badly or not
at all: using two different browsers without losing your mind, sharing a password
with your partner without sending it over WhatsApp, storing things that are not
passwords, leaving an ecosystem without losing everything, or being able to audit
the code of whoever keeps your secrets. We covered that in another article, and
the summary is that the big jump is not from one manager to another: it is from
none to any.

## What you were actually looking for

You were looking for a list. It is at `passwords.google.com`, in the Passwords app
on your iPhone, or in your browser settings, depending on what you use.

But while you are in there, look at one more thing: **how many times the same
password repeats in that list.** All three managers will tell you if you ask.
That number explains your real situation better than anything you can read about
encryption, this article included.

---

*Sources: Apple's security documentation on the iCloud Keychain —end-to-end
encrypted with keys Apple does not know, and rate-limited against brute force ·
Google Chrome help on sync, the sync passphrase and on-device encryption ·
Mozilla's documentation on how Firefox saves passwords (`logins.json` and
`key4.db`) and on the primary password.*