Why encrypt data locally? Why not store the encryption key elsewhere, or make it harder to obtain? The attacker's code, running as your user account, can do anything you can do. If your computer's infected with malware, an attacker can get decrypted access to the browser's storage areas. However, physically local attacks and malware are outside the threat model and, under these conditions, encrypted data would be vulnerable. This attack vector is often featured in blogs as a possible 'exploit' or 'vulnerability', which is an incorrect understanding of the browser threat model and security posture. On Linux, the storage area is Gnome Keyring or KWalletĪll these storage areas encrypt the AES key using a key accessible to some or all processes running as the user. The profile’s encryption key is protected using Chromium's OSCrypt and uses the following platform-specific OS storage locations:

The way to decrypt another user's passwords is if that user were logged on and the attacker had the user’s password or has compromised the domain controller.

Even if an attacker has admin rights or offline access and can get to the locally stored data, the system is designed to prevent the attacker from getting the plaintext passwords of a user who isn't logged in. The Microsoft Edge password manager encrypts passwords so they can only be accessed when a user is logged on to the operating system. Although not all of the browser’s data is encrypted, sensitive data such as passwords, credit card numbers, and cookies are encrypted when they are saved. This technique is called local data encryption. They're encrypted using AES and the encryption key is saved in an operating system (OS) storage area. Microsoft Edge stores passwords encrypted on disk. How are passwords stored in Microsoft Edge and how safe is this approach?

This article applies to Microsoft Edge version 77 or later.

Password safe windows 7 location