If you ever clicked «Save password» in that little window at the bottom of the screen, you already use a password manager. Nobody told you, you never chose one, and you have one anyway. Probably with a hundred entries in it.
That explains why the most repeated question about passwords is not «how do I make a good one», but «where are mine». People are not looking for a security manual: they are looking for a list they know exists and cannot find.
The list exists. But where it is stored matters far less than the answer to the next question, the one almost nobody asks: what does it take to open it?
Where they are, depending on what you use
In Chrome they are in Google’s password manager. They live in two places at
once: a copy on your computer and another in your Google Account, kept in sync.
You can see them at passwords.google.com or in the browser’s own settings.
On Safari, iPhone and Mac they are in the iCloud Keychain, which recently got an app of its own, Passwords. Same idea: on the device and in your Apple Account.
In Firefox they are in two files inside your profile, and the names are worth
knowing: logins.json, which holds your usernames and passwords encrypted, and
key4.db, which holds the key that decrypts them. Mozilla documents it exactly
like that, with those names.
In Edge they are in your Microsoft account, on the same scheme as Chrome. And on Android it is the same Google manager Chrome uses, even if you open it from the phone’s settings.
That is the answer you came for. Now the part that changes something.
Three models, and why they are not equivalent
All of them say «your passwords are encrypted». It is true in all three cases and it does not mean the same thing in any of them, because what changes is who holds the key.
Apple’s keychain is end-to-end encrypted. The keys that open it are not known to Apple; they exist only on your trusted devices. Apple publishes this in its security documentation, and adds a welcome detail: the system rate-limits attempts, precisely so that not even from inside its own infrastructure can anyone sit there guessing. There is nothing to switch on. It is already like that.
On Google, that mode exists but is optional. By default your passwords travel encrypted and are stored encrypted, but with keys Google manages. You can change it: a sync passphrase —or on-device encryption, depending on where you go in from— leaves the keys in your hands only. The practical difference is enormous and most people have never turned it on, because nobody told them it was there. It has a price, and the price has to be stated in full: if you forget that passphrase, nobody recovers your saved passwords. That is exactly what «only you» means.
In Firefox, without a primary password, encryption does not protect you from
whoever has your files. This is the most uncomfortable part of this article,
and it comes from Mozilla, not from us: without a primary password set, anyone
who copies logins.json and key4.db out of your profile can read your
credentials. The two files travel together: one carries the lock, the other the
key. Setting a primary password is what encrypts that key and breaks the pair.
The real scenario is not a movie
When people imagine their passwords being stolen, they imagine someone attacking servers. In practice the two cases that happen are far more domestic.
The first: someone with access to your unlocked computer. No skill required. The list is two clicks away in the browser settings, and even if it asks for your system password to reveal them, that password is known to whoever lives with you or has watched you type it.
The second: a program that copies your browser profile. It breaks nothing. It takes the files and opens them somewhere else, at leisure. That kind of software is common enough to have its own industry name, infostealer, and it is the exact reason why «but they are encrypted» always needs the follow-up question: encrypted, sure — and where is the key?
Against that second scenario, Apple’s model holds, Google’s holds if you turned the passphrase on, and Firefox without a primary password holds nothing.
What to do, in order of how much it changes
One. If you use Firefox, set a primary password. It is a checkbox in the privacy settings and it is, by a distance, the change on this list that protects the most for the least effort.
Two. If you use Chrome or Android, go into Google’s manager and turn on on-device encryption or the sync passphrase. Write it down somewhere physical before you switch it on, and understand what you are signing: from that moment, that phrase is the only door.
Three. Look at the password of the account that holds everything else. Your Google Account, your Apple ID or your Microsoft account stopped being «one more account» the moment you started saving passwords inside them: they are now the key to the rest. If you invented that password yourself eight years ago, run it through the checker and see what it says. And if you feel the urge, replace it with one from the generator.
Four. Turn on the second factor for that account. That is the step that turns «they know your password» into «they still do not get in».
Is this enough, or do I need a real manager?
It depends what for, and here the honest answer is not the one that sells.
For most people, the browser’s manager with encryption properly configured is enough, and it is infinitely better than the real alternative, which is not a better manager: it is the same password repeated across forty sites.
A dedicated manager wins when things show up that the browser’s does badly or not at all: using two different browsers without losing your mind, sharing a password with your partner without sending it over WhatsApp, storing things that are not passwords, leaving an ecosystem without losing everything, or being able to audit the code of whoever keeps your secrets. We covered that in another article, and the summary is that the big jump is not from one manager to another: it is from none to any.
What you were actually looking for
You were looking for a list. It is at passwords.google.com, in the Passwords app
on your iPhone, or in your browser settings, depending on what you use.
But while you are in there, look at one more thing: how many times the same password repeats in that list. All three managers will tell you if you ask. That number explains your real situation better than anything you can read about encryption, this article included.
Sources: Apple’s security documentation on the iCloud Keychain —end-to-end
encrypted with keys Apple does not know, and rate-limited against brute force ·
Google Chrome help on sync, the sync passphrase and on-device encryption ·
Mozilla’s documentation on how Firefox saves passwords (logins.json and
key4.db) and on the primary password.
Photo by Ron Lach · Pexels