Each browser, operating system, and password management application stores your saved passwords in a distinct location. Retrieving a forgotten credential requires knowing exactly where to look, as the access paths vary by device, browser, and storage type (local or cloud). This guide compares the main locations and their security levels to help you locate your passwords without guesswork.
Comparison of Saved Password Locations by Browser and System
The table below summarizes the access paths to saved passwords for the most common environments. It distinguishes between local storage and storage synchronized via an online account.
| Environment | Quick Access Path | Cloud Synchronization | Authentication Required |
|---|---|---|---|
| Chrome (desktop) | Settings > Autofill > Password Manager | Yes (Google account) | System password or biometrics |
| Chrome (Android) | Settings > Google Password Manager | Yes (Google account) | Device lock |
| Safari (macOS) | Password App (macOS Sequoia+) or System Preferences > Passwords | Yes (iCloud) | Touch ID or session password |
| Safari (iOS) | Settings > Passwords | Yes (iCloud) | Face ID, Touch ID, or code |
| Edge (Windows) | Settings > Passwords | Yes (Microsoft account) | Windows Hello password |
| Firefox | Settings > Privacy & Security > Logins and Passwords | Optional (Firefox Sync) | Master password if enabled |
| Dedicated Manager (Dashlane, Bitwarden, etc.) | Native app or browser extension | Yes (encrypted server by publisher) | Master password + 2FA |
One point stands out from this comparison: all browsers require local authentication before displaying a password in plain text. The difference lies in the robustness of this authentication and the scope of synchronization.
For a more detailed list of passwords on CGI Network, the complete path to each manager is described step by step.
Local Storage or Cloud Synchronization: Concrete Security Gaps
Cloud synchronization simplifies multi-device access, but it shifts the attack surface. A password stored only locally on your computer is accessible only with physical access to the machine and system authentication. In contrast, a password synchronized via a Google or Apple account becomes as vulnerable as the password for that account.
Main Risk of Synchronized Browser Storage
If your Google or Microsoft account is compromised (phishing, reused password), the attacker gains access to all your synchronized credentials from any device. Server-side encryption protects against a database leak, but not against legitimate account access.
Enabling two-step verification on the synchronization account significantly reduces this risk. Without this protection, the convenience of synchronization turns into a vulnerability.
Advantage of Dedicated Managers in This Respect
Managers like Dashlane or Bitwarden encrypt the vault with a master password that the publisher does not know (so-called “zero-knowledge” architecture). The online account serves only as a transport for the encrypted vault. Even if the server is compromised, passwords remain unreadable without the master password.
This architecture explains why these tools require a robust master password, distinct from any other credential. The price of this additional security: losing this master password means losing access to the entire vault, with no recourse possible with most publishers.
Passkeys and Passwords: Two Locations Not to Be Confused
Passkeys (FIDO access keys) now appear in the same interfaces as traditional passwords, whether in Chrome, Edge, Safari, or iOS and Android settings. This coexistence often creates confusion.
Passkeys are not passwords. They rely on a pair of cryptographic keys: the private key remains stored in the device’s security module or synchronized via the publisher’s account (Google, Apple, Microsoft), while the site receives only the public key. A stolen passkey on the server side is unusable without the associated device or account.
- On Chrome and Android, passkeys are managed in the Google Password Manager but stored separately and anchored to the device’s Credential Manager.
- On Windows and Edge, Microsoft documentation indicates that passwords and access keys are managed in separate sections, with passkeys linked to the Microsoft account or the TPM module.
- On iOS and macOS, the Password App (introduced with the latest versions) groups passwords and passkeys in the iCloud Keychain, with a visual indicator to distinguish them.
In practice, if you are looking for a credential and do not find it in the password section, check the access keys section. Some sites automatically migrate to passkeys after a successful first login, which can give the impression that the password has disappeared.
Exporting Your Passwords: Precautions Before Changing Managers
Most browsers and managers allow you to export saved passwords as a CSV file. Chrome offers this option in Settings > Password Manager > Export. Firefox, Edge, and Safari provide equivalent functions.
A CSV file contains all your credentials in plain text, without any encryption. Anyone who accesses this file has full access to your accounts. Three precautions reduce the risk:
- Perform the export on a trusted device, disconnected from the network if possible, and delete the file immediately after importing it into the new manager.
- Never store the CSV file in a synchronized folder (Google Drive, OneDrive, iCloud) or send it via messaging.
- Verify that the import into the new manager has worked before deleting the data from the old one by testing the login on two or three accounts.
Exporting remains the only reliable method to migrate from a browser to a dedicated manager, or vice versa. Firefox also allows direct import from Chrome without going through an intermediate file, which limits exposure.
The location of your saved passwords depends as much on the browser used as on the type of storage chosen. Regularly checking which credentials are synchronized, distinguishing passwords from passkeys, and treating any export file as highly sensitive data remains the foundation of reliable access management.