Windows stores passwords in multiple locations depending on the program

Windows does not keep all your passwords in one place. Different programs and services store them differently — some in encrypted vaults on your computer, some in your Microsoft account in the cloud, some in the browser itself. Where a password lives depends on what created it and what you chose to do with it when you first set it up.

The most common storage locations are the Credential Manager (for network and website passwords), the SAM file (for your Windows login password), browser password managers like Microsoft Edge or Chrome, and individual program databases. Each has different security levels and different ways to view or recover what is stored there.

Key Takeaways

  • Your Windows login password is stored in an encrypted file called the SAM database, which you cannot read directly even as the account owner.
  • Credential Manager in Windows stores passwords for websites and network resources, and you can view them through Settings if you know your Windows password.
  • Browser passwords (Edge, Chrome, Firefox) are stored separately in each browser's own encrypted database, not in Windows itself.
  • Third-party programs like email clients and banking apps often store passwords in their own encrypted vaults rather than in Windows.
  • If you forget a password, the program that created it usually has a recovery or reset option — Windows cannot retrieve it for you.

The Credential Manager: passwords for websites and network drives

Credential Manager is the Windows tool that stores usernames and passwords for websites you visit and network resources you connect to. It is built into Windows and sits in the Control Panel. When you check the box "Remember my password" on a website or network login, Windows often saves it here.

To view what is stored in Credential Manager, open the Control Panel, search for "Credential Manager," and click it. You will see two sections: "Web Credentials" (for websites) and "Windows Credentials" (for network drives and servers). Click any entry to expand it and see the username. To view the actual password, click "Show" — Windows will ask you to confirm your current Windows password first.

This is one of the few places where you can actually see a stored password on your own computer. However, Credential Manager only holds passwords you explicitly saved there. If you never checked "Remember password," it is not stored here.

The SAM file: your Windows login password

Your Windows login password is stored in a file called the SAM (Security Accounts Manager) database, located deep in the Windows system folder. This file is encrypted with a key that only Windows itself can read, even if you are logged in as the account owner.

You cannot open the SAM file and read your password from it — that is by design. Windows does not store passwords in a way that lets anyone, including you, retrieve them in plain text. If you forget your Windows password, you cannot recover it by looking at the SAM file. Instead, you must use Windows password reset tools, a password reset disk if you created one earlier, or your Microsoft account recovery options.

This encryption is actually a security feature. It means that even if someone steals your hard drive, they cannot easily extract your password from the SAM file without specialized tools and significant time.

Browser password managers: Edge, Chrome, and Firefox

When you save a password in Microsoft Edge, Google Chrome, or Firefox, that password is stored in the browser's own database, not in Windows. Each browser keeps its passwords in a separate encrypted folder.

In Microsoft Edge, you can view saved passwords by opening Settings, clicking "Passwords," and then clicking "Manage passwords." You will see a list of saved sites. Click any one and select the eye icon to reveal the password — Edge will ask you to confirm your Windows password first.

Chrome and Firefox work similarly. In Chrome, go to Settings, click "Passwords," find the site you want, and click the eye icon. In Firefox, go to Settings, click "Privacy & Security," scroll to "Logins and Passwords," and click "Saved Logins."

These browser passwords are tied to your browser profile, not to Windows itself. If you switch browsers or use a different computer, those passwords do not follow you unless you sync them to a cloud account (like a Google account or Firefox account).

Email clients and banking apps: their own encrypted vaults

Programs like Outlook, Thunderbird, and banking apps store passwords in their own encrypted databases, not in Windows Credential Manager or the Windows password system. These programs typically encrypt the password with a key that only that program knows.

To view or change these passwords, you usually have to go into the program's settings. In Outlook, for example, you go to File, then Account Settings, then select the account and click "Change." You cannot view the stored password directly — you can only change it.

If you forget a password stored in one of these programs, the program itself usually has a "Forgot Password" or "Reset Password" option that sends a recovery link to your email. Windows cannot help you retrieve it because Windows does not have access to that program's encrypted vault.

OneDrive and cloud-synced passwords: your Microsoft account

If you use a Microsoft account to log into Windows (rather than a local account), your passwords can be synced to Microsoft's servers. This includes passwords saved in Edge and some other Microsoft programs. This sync is optional — you can turn it off in Settings under "Accounts" and "Sync your settings."

When passwords are synced to your Microsoft account, they are encrypted end-to-end, meaning Microsoft cannot read them. However, they are stored on Microsoft's servers, not just on your computer. If you sign into Windows on another device with the same Microsoft account, those synced passwords become available on that device too.

You can view and manage synced passwords by going to your Microsoft account online at account.microsoft.com, clicking "Security," and then "Password & security info." From there you can see which devices have access to your synced passwords and remove access if needed.

What happens if you forget a password stored in Windows

If you forget a password that Windows stored, your options depend on where it is stored. For Credential Manager passwords, you can reset them through the website or service that created them — most have a "Forgot Password" link. For your Windows login password, you can use a password reset disk (if you created one), your Microsoft account recovery options, or local account recovery if you set up security questions.

For browser passwords, each browser has its own recovery process. Most let you reset passwords through the website itself. For program-specific passwords (email, banking), go to that program's website and use their password recovery tool.

The key point: Windows does not have a master password recovery tool that unlocks everything. Each password is tied to the service or program that created it, and each has its own recovery path.

Frequently Asked Questions

Can I see all my passwords in one place on Windows?

No. Passwords are scattered across Credential Manager, your browser, your Microsoft account, and individual programs. There is no single Windows tool that shows everything. You can view Credential Manager passwords and browser passwords separately, but program-specific passwords are locked inside those programs.

Is it safe to let Windows remember my passwords?

Credential Manager and browser password managers use encryption, so they are reasonably safe if your Windows password is strong and your computer is not physically stolen. However, if someone gains access to your Windows account, they can view your stored passwords. Using a password manager like Bitwarden or 1Password gives you more control and works across devices.

What if I forgot my Windows login password?

If you have a Microsoft account, go to the Windows login screen, click "I forgot my password," and follow the recovery steps using your email or phone number. If you have a local account, you can use a password reset disk if you created one earlier, or you may need to use Windows recovery options or contact Microsoft support.

Can I export all my passwords from Windows?

You can export passwords from some browsers (Edge, Chrome, Firefox all have export options in their settings), but Windows Credential Manager does not have a built-in export feature. Third-party password managers can import from browsers, but not directly from Windows system storage.

Are my passwords safer on my computer or in the cloud?

Both have trade-offs. Passwords stored only on your computer are not exposed to cloud breaches, but they are lost if your hard drive fails. Passwords synced to the cloud (like through your Microsoft account) are backed up and available on other devices, but they depend on your cloud account security. The safest approach is a strong password manager with two-factor authentication on your account.