Login Data
Definition
Chromium SQLite database of saved credentials. Passwords are stored encrypted; on Windows the OS master key sits under DPAPI scoped to the user account, on macOS under Keychain, on Linux under libsecret or kwallet.
- Format
- SQLite database
- Found in
- Chromium-based browsers
- Windows key store
- DPAPI, scoped to the user account
- macOS key store
- Keychain
- Linux key store
- libsecret or kwallet
Common questions
Why can't a recovered Login Data file simply be opened to read passwords?+
The stored credentials are encrypted with an OS-level master key tied to the specific user account and machine, so decrypting them requires access to that key store, not just the database file itself.
Does the encryption method for Login Data differ across operating systems?+
Yes, the underlying key store differs by platform: DPAPI on Windows, Keychain on macOS, and libsecret or kwallet on Linux, so extraction and decryption steps must match the source OS.
Related terms
- Hindsight
- An open-source Chromium artefact parser maintained against NIST CFTT-friendly test data. Parses History, Cookies, Local Storage, Downloads, Login Data metadata and Cache...
- Places.sqlite
- Firefox's combined history and bookmarks store. Visit timestamps are PRTime (microseconds since 1 January 1970). cookies.sqlite, formhistory.sqlite, key4.db and logins.json live alongside...
- Section 63 BSA
- Bharatiya Sakshya Adhiniyam 2023 provision that requires a statutory certificate for admissibility of a copy of an electronic record. Applies to browser-extracted...
- Session Restore
- The browser feature that reopens tabs after a restart. Chrome writes Current Tabs / Current Session / Last Tabs / Last Session...
- User Data Directory
- The Chromium profile root that holds History, Cookies, Login Data, Web Data, Cache, Local Storage and Sessions. The Default profile is the...