Windows stores passwords in multiple locations depending on the account type and what the password protects
Windows does not keep all passwords in one place. A password for your Microsoft account lives in a different location than a password for a website you saved in your browser, which is different again from a password for a local network drive. Understanding where each type lives helps you recover a forgotten password or move your passwords to a new device.
The three main storage locations are your Microsoft account (which syncs across devices if you sign in), your local Windows user account (stored only on that computer), and your browser or third-party password manager (which may or may not sync). Each has different recovery options and different security implications.
Key Takeaways
- Microsoft account passwords are stored on Microsoft's servers, not on your computer, so you can reset them through the Microsoft account website even if you cannot sign in to Windows.
- Local Windows user account passwords are stored as encrypted hashes on your computer's hard drive in a file called SAM, and cannot be recovered — only reset through a recovery method you set up beforehand.
- Passwords you save in Microsoft Edge, Chrome, or Firefox are stored in encrypted form in your browser's profile folder, and you can view them through the browser's settings if you remember your Windows password.
- Third-party password managers like Bitwarden or 1Password store passwords on their own servers or in encrypted files, separate from Windows entirely.
Microsoft account passwords stored on Microsoft's servers
If you sign into Windows with a Microsoft account (the kind that uses an email address), your password is not stored on your computer at all. Microsoft keeps it on their servers. When you type your password at the Windows login screen, Windows sends it to Microsoft to verify, then creates a local copy of your account on your computer if the password is correct.
This means you cannot find your Microsoft account password by looking on your computer. You also cannot reset it using tools on your computer. Instead, go to account.microsoft.com, click "Security" in the left menu, then "Change your password" under the "Password" section. You will need to verify your identity — usually by entering a code sent to your recovery email or phone number.
If you cannot remember your password and do not have access to your recovery email or phone, Microsoft has a separate account recovery process at account.live.com/password/reset. This process asks security questions or other verification methods to confirm you own the account.
Local Windows user account passwords stored as encrypted hashes
If you created a local Windows user account (one that does not use an email address), your password is stored on your computer's hard drive in an encrypted form called a hash. The file is called SAM (Security Accounts Manager) and lives in C:\Windows\System32\config\SAM. You cannot read this file directly — Windows locks it while the system is running.
The important thing to know is that Windows passwords cannot be recovered, only reset. If you forget a local account password, you have two options: use a password reset disk you created beforehand, or reset the password through another administrator account on the same computer. If you have neither, you will need to reinstall Windows or use a third-party password reset tool, both of which erase your data or require physical access to the computer.
This is why Microsoft recommends using a Microsoft account instead of a local account — if you forget a Microsoft account password, you can reset it from any device with internet access.
Browser passwords stored in your browser's profile folder
When you save a password in Microsoft Edge, Chrome, or Firefox, the browser stores it in an encrypted file inside your user profile folder. The exact location depends on which browser you use.
In Microsoft Edge, passwords are stored in C:\Users\[YourUsername]\AppData\Local\Microsoft\Edge\User Data\Default\Login Data. In Chrome, they are in C:\Users\[YourUsername]\AppData\Local\Google\Chrome\User Data\Default\Login Data. In Firefox, they are in C:\Users\[YourUsername]\AppData\Roaming\Mozilla\Firefox\Profiles\[RandomString].default-release\logins.json.
You do not need to find these files manually. All three browsers let you view saved passwords through their settings. In Edge or Chrome, go to Settings, then "Passwords" or "Autofill", then "Manage passwords". Click the eye icon next to any password to reveal it — you will need to enter your Windows password to do this. In Firefox, go to Settings, then "Privacy & Security", scroll to "Logins and Passwords", and click "Saved Logins".
These passwords are encrypted with your Windows user account password as part of the key. If someone else logs into your Windows account, they can see all your saved browser passwords. If someone gains access to your computer without logging in, they cannot easily read these files.
Third-party password managers store passwords separately
If you use Bitwarden, 1Password, LastPass, or another password manager, those passwords are not stored in Windows at all. They live in the password manager's own encrypted vault, which may be stored on the company's servers or on your computer depending on the service.
Bitwarden and 1Password sync passwords to their servers and encrypt them before sending, so the company cannot read them. LastPass stores passwords on their servers in encrypted form. All three require you to remember one master password to unlock the vault.
If you forget your master password, the password manager cannot recover it for you — the encryption is designed so that even the company cannot access your vault without it. Some services offer account recovery options if you set up a recovery code beforehand, but this is not may provide. Check your password manager's documentation for what recovery options are available.
Network and shared drive passwords stored in Windows Credential Manager
If you save a password for a network drive, shared folder, or remote desktop connection, Windows stores it in Credential Manager. You can access this by typing "Credential Manager" into the Windows search box and opening "Credential Manager" from the results.
In Credential Manager, click "Windows Credentials" to see passwords for network resources. Click the arrow next to any entry to expand it and see the username and password. You will need to be signed into your Windows account to view these.
These credentials are encrypted with your Windows user account password, so anyone who logs into your account can see them. They are not synced to other devices — they stay only on the computer where you saved them.
What happens to passwords when you upgrade or move devices
If you sign into a new computer with your Microsoft account, Windows automatically syncs your Microsoft account password (you use the same one on both devices) and any passwords you saved in Microsoft Edge if you turned on sync in Edge settings. Browser passwords in Chrome and Firefox do not sync automatically unless you turn on sync in those browsers separately.
Local account passwords, network credentials, and passwords in third-party password managers do not move to a new device. You will need to re-enter them or export them from the old device first. Most password managers have an export feature for this purpose, though the exported file is usually unencrypted and should be handled carefully.
Frequently Asked Questions
Can I see my Windows password if I forgot it?
No. Windows passwords are stored as encrypted hashes that cannot be reversed. If you forgot a Microsoft account password, you can reset it at account.microsoft.com. If you forgot a local account password and have no recovery method set up, you will need to reinstall Windows or use a third-party reset tool.
Are my saved browser passwords safe if someone gets my computer?
They are encrypted with your Windows password, so someone would need to log into your Windows account to read them. If your Windows password is weak or you leave your computer unlocked, they can access them. Using a strong Windows password and locking your computer when you step away protects them.
What if I want to move my passwords to a different password manager?
Most password managers have an export feature that saves your passwords to a file. You can then import that file into the new password manager. The exported file is usually unencrypted, so keep it find and delete it after importing. Check your current password manager's help documentation for the export steps.
Do I need to do anything special to back up my passwords?
Microsoft account passwords are backed up automatically on Microsoft's servers. Browser passwords sync if you turn on sync in your browser settings. For local account passwords and network credentials, write down recovery codes or backup methods before you need them. For third-party password managers, enable their backup or recovery features in settings.
Can Windows administrators see my passwords?
An administrator on your computer can reset your local account password, but cannot see the password itself. They can see passwords you saved in Credential Manager and browser passwords if they log into your account. They cannot see your Microsoft account password — that is stored only on Microsoft's servers.