Windows does not store your password in a place you can read
Your Windows password is not saved as plain text anywhere on your computer. Instead, Windows converts it into a hash — a one-way mathematical code that looks like random characters. Even if someone opened the file where it is stored, they would see only the hash, not your actual password. This design means that if someone steals the file, they cannot straightforward read your password out of it.
The hash is stored in a database called the Security Accounts Manager (SAM), which Windows keeps locked down with multiple layers of protection. You cannot open this file while Windows is running, and even system administrators cannot view the original password from the hash. If you forget your password, Windows cannot show it to you — the only option is to reset it.
Key Takeaways
- Windows converts your password into a hash (a one-way code) rather than storing the password itself, so even administrators cannot read your original password.
- The hash is stored in the SAM database, which is protected by Windows and cannot be accessed while the operating system is running.
- If you forget your password, you must reset it through Windows recovery options or a password reset disk — there is no way to retrieve the original.
- Third-party password recovery tools work by running outside Windows or by exploiting vulnerabilities, not by reading a stored password file.
Where the hash is physically located
On Windows 10 and Windows 11, the SAM database is stored at C:\Windows\System32\config\SAM. However, this file is locked by Windows while the system is running, and you cannot open it even with administrator rights. The file is encrypted and protected by another file called SYSTEM, which holds the encryption key.
Windows also stores password information in a second location for newer systems: the Credential Manager. This stores passwords for websites, email accounts, and network resources that you have saved in Windows. You can see what accounts are stored there (by going to Settings > Accounts > Credential Manager), but you still cannot view the actual passwords — only the usernames and which service they belong to.
Why you cannot access it yourself
The SAM file is intentionally locked while Windows runs because if anyone could read it, they could steal every password hash on the computer. Even if the hashes are encrypted, a determined attacker with enough computing power could try millions of guesses until one matches. By keeping the file locked and encrypted, Windows makes this attack much harder.
If someone wanted to access the SAM file, they would have to boot the computer from a different operating system (like a Linux USB drive) or use specialized recovery tools that run before Windows fully loads. This is why physical security matters — if someone has direct access to your computer and time to work with it, they can potentially extract password hashes. But they still cannot straightforward read your password; they would have to crack the hash, which can take days or longer depending on password strength.
What happens when you reset your password
When you reset a Windows password through the built-in recovery options, Windows does not retrieve the old password. Instead, it creates a new hash and replaces the old one in the SAM database. This is why resetting your password through Settings or a password reset disk works — you are not recovering the old password, you are creating a new one.
If you use a Microsoft account to sign in to Windows, the password is also stored on Microsoft's servers. When you change your password through the Microsoft account website, Windows syncs that change to your local computer. But again, Microsoft stores only the hash, not the password itself.
How password recovery tools claim to work
Third-party password recovery software advertises the ability to "recover" or "reveal" Windows passwords. These tools do not actually read the password from the SAM file. Instead, they typically work by one of two methods: they either reset the password (replacing the hash with a new one, just like the built-in reset option), or they extract the hash and attempt to crack it using a dictionary or brute-force attack.
Cracking a hash means running millions of guesses through the same hashing algorithm until one produces the same hash as the one stored on your computer. A strong password (long, with mixed characters) can take weeks or longer to crack. A weak password might crack in minutes. These tools are useful if you have locked yourself out, but they do not "find" your password — they either replace it or guess it.
Why this matters for your security
The fact that Windows does not store readable passwords is a security feature, not a limitation. It means that if your computer is stolen or if malware infects it, the thief or attacker cannot straightforward copy a file and read all your passwords. They would have to crack the hashes, which is much harder and takes much longer.
This is also why a strong password matters. A password with 12 or more characters, including uppercase, lowercase, numbers, and symbols, creates a hash that would take years to crack with current computing power. A straightforward password like "password123" might crack in hours. The hash itself does not reveal how strong your password is, but the time it takes to crack it does.
Local accounts versus Microsoft accounts
If you sign in with a local account (a username and password created on your computer), the password hash is stored only in the SAM database on your computer. If you sign in with a Microsoft account, Windows stores the hash both locally and on Microsoft's servers. This means you can reset a Microsoft account password from any computer with internet access, but a local account password can only be reset from that specific computer.
Both types of accounts use the same hashing method, so the security principle is the same: your actual password is never stored anywhere in readable form. The difference is where the hash is kept and how you can reset it if you forget.
Frequently Asked Questions
Can I see my password if I saved it in Windows?
If you saved a password in Credential Manager (for websites or email), you can see the username but not the password itself. Windows hides the password field by default. Some browsers like Chrome or Edge allow you to view saved passwords, but Windows itself does not.
What if I have administrator rights — can I read the SAM file?
No. Even as an administrator, you cannot read the SAM file while Windows is running because it is locked by the operating system. You would need to boot from outside Windows or use specialized tools that run before Windows fully loads.
If I forget my password, can Microsoft or my IT department retrieve it?
No. Microsoft and IT departments cannot retrieve your password because it is not stored in a readable form anywhere. They can only reset it, which means creating a new password hash. You will need to set a new password.
Does Windows ever send my password to Microsoft?
No. When you sign in with a Microsoft account, Windows sends only the hash to Microsoft's servers, not your actual password. Microsoft never sees your password in readable form.
Why do some password recovery tools claim to recover passwords?
They use misleading language. These tools either reset your password (replacing the hash) or crack it (guessing until they match the hash). They do not recover the original password because it is not stored anywhere to recover.