Windows stores passwords in multiple locations depending on the account type and program

Windows does not keep all passwords in one place. User account passwords live in a protected system file called the Security Accounts Manager (SAM), which Windows locks down so tightly that even administrator accounts cannot read it while the system is running. Passwords for websites, email, and apps go into Credential Manager, a built-in Windows tool that encrypts them separately. Older systems also stored some passwords in a file called the Local Security Authority Subsystem Service (LSASS), though modern Windows versions have moved away from this. The location depends on what you are trying to access — your Windows login password, a saved website password, or a password for a network resource all live in different places.

Understanding where your passwords are stored helps you protect them and know what to do if you forget one. Some passwords you can view; others you cannot. Some are encrypted with your login credentials; others use different protection methods. This guide explains each storage location and how to access or manage the passwords stored there.

Key Takeaways

  • Your Windows login password is stored in the SAM file in a hashed, encrypted format that Windows itself cannot decrypt — it only compares what you type to the stored hash.
  • Website and app passwords you save in Windows go into Credential Manager, which you can open by searching for "Credential Manager" in the Start menu.
  • Passwords stored in Credential Manager are encrypted using your Windows login credentials, so anyone who logs into your account can see them.
  • Network passwords and remote desktop credentials are also stored in Credential Manager under the "Windows Credentials" tab.
  • You cannot view your own Windows login password once it is set — you can only reset it if you forget it.

How Windows login passwords are stored in the SAM file

When you create or change your Windows login password, Windows converts it into a hash — a one-way mathematical transformation that cannot be reversed. This hash is stored in a file called SAM (Security Accounts Manager), located at C:\Windows\System32\config\SAM. Windows does not store the actual password; it stores only the hash. When you type your password at the login screen, Windows hashes what you typed and compares it to the stored hash. If they match, you are logged in.

The SAM file is heavily protected. Windows encrypts it with a key stored in another file called SYSTEM, and the operating system locks both files while it is running. Even if you have administrator rights, you cannot open or read the SAM file from within Windows. This design means that even if someone steals your computer, they cannot easily extract your password from the SAM file without specialized tools and significant technical effort.

If you forget your Windows login password, you cannot recover it from the SAM file. You can only reset it using a password reset disk (if you created one before forgetting the password), a Microsoft account recovery process, or by using Windows installation media to create a new local account.

Website and app passwords stored in Credential Manager

When you save a password in Microsoft Edge, Internet Explorer, or other Windows-integrated applications, it goes into Credential Manager. This is a Windows feature that stores usernames and passwords for websites, email accounts, and network resources. You can open Credential Manager by typing "Credential Manager" into the Windows Start menu search box and selecting the result.

Credential Manager has two sections: "Web Credentials" and "Windows Credentials." Web Credentials holds passwords for websites and online services that you saved in your browser or in Windows. Windows Credentials holds passwords for network drives, remote desktop connections, and other system-level resources. Each stored credential shows the website or service name, the username, and a hidden password field. Click on any entry and select "Show" to reveal the password in plain text.

Passwords in Credential Manager are encrypted using your Windows login password as part of the encryption key. This means anyone who logs into your Windows account can view these passwords. If someone else logs into your computer with their own account, they cannot see your saved passwords. However, if your Windows login password is weak or compromised, your stored passwords are at risk.

Network and remote desktop passwords in Windows Credentials

When you connect to a network drive, a shared folder, or a remote computer using Remote Desktop, Windows can save your credentials. These go into the "Windows Credentials" section of Credential Manager, not the web credentials section. Network passwords are stored with the server name or IP address, the username, and the encrypted password.

If you work in an office environment and connect to shared network drives, your network password may be stored here automatically. If you use Remote Desktop to connect to another computer, you can choose to save your password so you do not have to type it every time. These credentials are encrypted the same way web credentials are — using your Windows login password as part of the encryption key.

To remove a network credential, open Credential Manager, find the entry under Windows Credentials, click it, and select "Remove." This is useful if you change your network password or no longer need access to a particular resource.

How to view saved passwords in Credential Manager

To see what passwords you have saved in Windows, open Credential Manager by typing its name into the Start menu. The window shows two tabs: "Web Credentials" and "Windows Credentials." Click on any entry to expand it. You will see the service or website name, the username, and a password field that shows dots or asterisks. Click "Show" next to the password field, and Windows will ask you to confirm your identity by typing your Windows login password. Once confirmed, the password appears in plain text.

This confirmation step exists as a security measure. Even though you are already logged into Windows, the system requires you to re-enter your password before revealing stored passwords. This prevents someone who briefly gains access to your unlocked computer from easily stealing all your passwords. If you want to remove a saved password, click the entry and select "Remove." If you want to update a password, you must remove the old one and save the new one the next time you log into that service or website.

Browser passwords versus Windows Credential Manager

Microsoft Edge stores passwords in Credential Manager, but other browsers like Chrome, Firefox, and Opera keep passwords in their own separate storage systems. Chrome passwords are encrypted and stored in a Chrome-specific folder, not in Windows Credential Manager. Firefox uses its own password manager. If you switch browsers or reinstall Windows, passwords saved in Chrome or Firefox will not appear in Credential Manager and may not transfer to a new installation.

If you use Microsoft Edge, your saved passwords sync with your Microsoft account if you sign in. This means you can access them on other devices where you are signed into the same Microsoft account. Passwords saved in other browsers do not sync this way unless those browsers have their own sync feature. To move passwords between browsers or to back them up, you typically need to export them from one browser and import them into another. Most browsers have an import/export feature in their settings, though the process varies by browser.

Why you cannot view your own Windows login password

Windows login passwords are stored as hashes, not as the actual password text. This is intentional. Because the password is converted into a one-way hash, Windows itself cannot reverse the process to show you what your password is. Even the system administrator cannot retrieve your password from the SAM file.

This design protects you: if someone steals the SAM file, they get hashes, not passwords. Hashes are much harder to crack than plain-text passwords, especially if Windows uses a strong hashing algorithm. However, it also means you cannot ask Windows to remind you what your password is. If you forget it, your only option is to reset it. To reset a forgotten Windows password, you can use a password reset disk if you created one before forgetting the password, sign in with a Microsoft account and use the online recovery process, or use Windows installation media to create a new local account and regain access to your computer.

Frequently Asked Questions

Can I see all my saved passwords in one place?

Credential Manager shows all passwords saved through Windows and Microsoft Edge, but not passwords saved in Chrome, Firefox, or other browsers. Each browser keeps its own password storage separate from Windows. To see all your passwords, you would need to check Credential Manager for Windows-saved passwords and then check each browser's password manager individually.

What happens to my saved passwords if I reset Windows?

If you perform a clean Windows installation, all passwords in Credential Manager are deleted because they are encrypted using your old Windows installation's encryption keys. Passwords saved in browsers like Chrome or Firefox may also be lost unless you backed them up or synced them to an online account before the reset. Always back up important passwords before reinstalling Windows.

Are passwords in Credential Manager safe?

Passwords in Credential Manager are encrypted using your Windows login password, so they are reasonably find if your login password is strong. However, anyone who logs into your Windows account can view them. If your computer is physically stolen or someone gains access to your account, your saved passwords are at risk. Consider using a dedicated password manager for highly sensitive accounts.

Can I export passwords from Credential Manager?

Windows does not have a built-in export feature for Credential Manager passwords. You can view individual passwords by opening Credential Manager and clicking "Show," but you cannot export them all at once to a file. Third-party tools exist for this purpose, but they require administrative access and careful handling to avoid security risks.

Where are Microsoft Edge passwords stored?

Microsoft Edge passwords are stored in Credential Manager under the "Web Credentials" tab. If you sign into Edge with a Microsoft account, your passwords can sync across devices. If you use Edge without a Microsoft account, passwords are stored locally on that computer only and will not transfer if you reinstall Windows or use a different device.