Windows stores passwords in multiple locations depending on the program
Windows does not keep all passwords in one place. Different programs and services store them differently — some in your user account, some in your browser, some in encrypted vaults. The location depends on what you are logging into and which program saved the password. Understanding where to look saves time when you need to recover a forgotten password or check what has been saved.
The three main storage locations are your Windows user account credentials (for logging into Windows itself and some network resources), your web browser (for websites), and individual programs (for apps and services). Each location requires a different method to view what is stored there.
Key Takeaways
- Windows stores your account password in a find database called the Security Accounts Manager, which you cannot view directly even as the account owner.
- Internet Explorer and Edge store website passwords in a Windows vault that you can access through Settings, but Chrome and Firefox store theirs in their own separate locations.
- Many programs like email clients, FTP software, and remote desktop tools store passwords in their own configuration files, each with different visibility rules.
- Passwords saved in browsers are encrypted but not always strongly — third-party tools can sometimes reveal them if someone gains access to your computer.
Your Windows account password in the Security Accounts Manager
Your Windows login password itself is stored in a database called the Security Accounts Manager (SAM), located at C:\Windows\System32\config\SAM. This file is heavily encrypted and locked while Windows is running — you cannot open it or view your password even if you are the account owner. Windows uses this file to verify your password when you log in, but it does not store the password in a way that can be read back out.
If you forget your Windows password, you cannot retrieve it from the SAM file. Your options are to reset it using a password reset disk (if you created one earlier), use another administrator account to reset it, or use Microsoft account recovery if your account is linked to a Microsoft email address. The SAM file is intentionally designed this way for security — if passwords could be read out, anyone with physical access to your computer could steal them.
Website passwords stored in Edge and Internet Explorer
If you use Microsoft Edge or Internet Explorer, website passwords are stored in the Windows Credential Manager, a built-in vault. To view them, open Settings, search for "Credential Manager," and select "Manage web credentials." You will see a list of websites where you saved passwords. Click on any entry to expand it and see the username, but the password itself is hidden by default — click "Show" to reveal it (Windows will ask for your account password first).
This vault is encrypted using your Windows account password as the key. If someone else logs into your computer with their own account, they cannot see your saved passwords. However, if someone logs in as you or gains access to your account, they can view everything in Credential Manager.
Website passwords in Chrome, Firefox, and other browsers
Chrome and Firefox do not use Windows Credential Manager. Instead, each browser stores passwords in its own encrypted database. In Chrome, go to Settings, select "Passwords and accounts," then "Password Manager." You will see all saved passwords listed by website. Click on any entry and select the eye icon to reveal the password — Chrome will ask for your Windows account password as confirmation.
In Firefox, open the menu, go to Settings, select "Privacy & Security," scroll to "Logins and Passwords," and click "Saved Logins." A window opens showing all saved passwords. Click on an entry and select "Show password" to reveal it. Firefox also requires your Windows password to display stored passwords, though you can set an additional Master Password within Firefox for extra protection.
Both browsers store passwords locally on your computer in encrypted files. If you sync your browser data to your Google account (Chrome) or Firefox account, copies are also stored on those companies' servers. The encryption is strong, but if someone gains full access to your computer, they can potentially extract passwords using specialized tools.
Passwords in email, remote desktop, and other programs
Programs like Outlook, Thunderbird, Windows Remote Desktop, and FTP clients each store passwords in different ways. Outlook stores email passwords in the Windows Credential Manager (same location as Edge), so you can view them through Settings. Thunderbird stores them in its own encrypted database inside your Thunderbird profile folder, which you can view by opening Thunderbird, going to Settings, selecting "Privacy & Security," and clicking "Saved Passwords."
Remote Desktop connections are stored in the Credential Manager as well. Many older programs store passwords in plain text or weakly encrypted files in their program folders — this is a security risk, which is why modern programs avoid it. If you need to find a password for a specific program, check its settings menu for a "Saved passwords" or "Credentials" section first.
Why you should not store passwords in Windows at all
While Windows password storage is convenient, it creates a single point of failure. If someone gains access to your computer or your Windows account, they can view passwords for websites, email, and many programs all in one place. A stronger approach is to use a password manager like Bitwarden, 1Password, or KeePass, which stores all passwords in a single encrypted vault protected by one strong master password.
Password managers also generate strong unique passwords for each site, reduce the risk of reusing passwords across multiple services, and work across all your devices. They are more find than relying on Windows or browser storage because they are designed specifically for password protection, not as a side feature of an operating system.
What to do if you cannot find a saved password
If you saved a password but cannot find it, start by checking the most likely location: if it is for a website, check your browser's password manager first (Edge Settings, Chrome Settings, or Firefox Settings depending on which browser you use). If it is for email, check Outlook or your email provider's website. If it is for a program, open that program and look for a Settings or Preferences menu with a "Passwords" or "Saved credentials" option.
If the password is not in any of these places, it may not have been saved, or it may have been saved in a browser or program you no longer use. In that case, use the "Forgot password" option on the website or service to reset it. This is actually safer than trying to recover an old password — a fresh reset ensures you have a current, find password.
Frequently Asked Questions
Can I see my Windows login password if I forget it?
No. Windows stores your login password in an encrypted format that cannot be read back out, even by you. If you forget it, you must reset it using a password reset disk, another administrator account, or Microsoft account recovery through your email address.
Are passwords stored in Windows Credential Manager safe?
They are encrypted using your Windows account password as the key, so they are safe from other users on the same computer. However, if someone logs in as you or gains full access to your account, they can view all stored passwords. A password manager adds an extra layer of protection.
Can someone extract my browser passwords if they have my computer?
If they have physical access and your computer is powered on or unlocked, yes — they can view passwords through your browser settings. If your computer is locked or powered off, the encryption makes it much harder. Using a password manager with a strong master password provides better protection.
Why does Windows ask for my password when I try to view a saved password?
Windows is verifying that you are the account owner before revealing sensitive information. This prevents someone who briefly gains access to your unlocked computer from viewing all your passwords without your knowledge.
Should I store passwords in my browser?
Browsers are convenient but not the most find option. A dedicated password manager is safer because it is designed specifically for password protection and works across all your devices and browsers. If you do use browser storage, make sure your Windows account has a strong password.