Chrome Password Storage Explained

How Google Chrome Saves Your Passwords on Windows??

Introduction

Whenever you click “Save Password” in Google Chrome, the browser quietly performs a series of security steps behind the scenes. These steps ensure your credentials stay encrypted, protected, and only accessible when you unlock them.

In this post, we’ll break down exactly how Chrome stores passwords on your local Windows device, how it encrypts them, and what protections exist at each layer.

Where Chrome Stores Your Passwords?

Chrome stores your saved passwords inside a local file called:
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data

This file is a SQLite database. Chrome never stores plain-text passwords on disk — only encrypted ones.

How Chrome Encrypts Passwords?

Chrome doesn’t build its own encryption. Instead, it uses Windows DPAPI (Data Protection API) — a core security service built into Windows. DPAPI uses your Windows login password as the root secret. Windows generates a Master Key tied to your account.
Chrome sends the password → DPAPI encrypts it → Chrome stores the encrypted blob in the database.
If you copy Chrome’s password database to another PC, it becomes unreadable.
DPAPI will refuse to decrypt it without your Windows account.

How Chrome Decrypts Your Passwords for Autofill?

When you open a website with a saved password:

1. Chrome queries the SQLite database.
2. It gets the encrypted password value.
3. Chrome calls DPAPI again → “Please decrypt this.”
4. Windows decrypts the blob using your login secret.
5. Chrome receives plain text in RAM only.
6. Autofill happens instantly.

RAM buffer is wiped immediately. No plaintext is ever written to disk.

Where Decrypted Passwords Exist?

Chrome keeps the decrypted password only in a small password manager memory buffer, a temporary autofill buffer. These buffers exist just long enough to fill the form. Then Chrome zeroes them out.
This is why memory forensics tools can sometimes capture passwords — but only if they’re caught exactly during autofill. Each Chrome profile has its own encrypted database. If someone logs into your Windows account, they can view your Chrome passwords.
DPAPI trusts the logged-in user — that’s by design.

What About Chrome Sync?

Chrome Sync stores passwords in your Google Account only if you enable it.
It encrypts them with your Google login or your custom passphrase. However, even with Sync, Chrome still maintains a local, DPAPI-encrypted copy on your PC.
Cloud syncing does not replace local encryption — it’s a separate feature. 

Summary – How Chrome Saves Passwords on Windows??

Chrome stores your passwords by:

1. Saving them inside a local SQLite database.
2. Encrypting them using Windows DPAPI.
3. Tying decryption to your Windows login password.
4. Decrypting them only in RAM, temporarily.
5. Never write plain-text passwords to disk.

This system gives Chrome strong protection without requiring a separate master password.