🛡️ Microsoft Edge Stores Every Saved Password in Plaintext — What You Need to Do Now
On this page
- Why Edge's Plaintext Passwords Are a Bigger Risk Than Microsoft Admits
- How Edge Compares to Chrome and Firefox
- Who Can Actually Steal Edge Passwords?
- What Microsoft Said — and What It Didn't Say
- How to Protect Yourself Right Now
- What About Other Browsers?
- The Bigger Picture: 2026 Password Security
- FAQs: Microsoft Edge Password Security
A Norwegian security researcher discovered something alarming this week: Microsoft Edge loads every single saved password into your computer's memory as plaintext the moment the browser opens — and keeps them there, completely readable, for the entire session. Microsoft's response? It's "by design." We've spent the last several days digging into what this actually means, testing it against other browsers, and researching the practical risks. The short version is troubling: any malicious software that finds its way onto your machine can scoop up every password you've ever saved in Edge without needing any special privileges.
That's not a theoretical risk. According to ThreatLocker, approximately 1.8 billion credentials were stolen globally by infostealer malware in the first half of 2025 alone. Those malware kits rent for around $200 a month on hacker forums and require zero technical skill to operate. This discovery doesn't create a new vulnerability — it widens an existing one dramatically.
Why Edge's Plaintext Passwords Are a Bigger Risk Than Microsoft Admits
Here's the thing about storing passwords in plaintext memory: the barrier to reading them is shockingly low. You don't need to be a nation-state actor or a sophisticated hacking group. Any piece of software running on your machine — a dodgy browser extension, a downloaded game that turned out to be malware, even a malicious PDF — can reach into Edge's process memory and pull out every single credential.
We tested this logic against our own setups. Chrome requires explicit action — opening the password manager UI or triggering autofill — before credentials enter memory. Edge does it automatically at launch. Think of it like the difference between leaving your house keys in a locked drawer versus taping them to the front door. In both scenarios someone determined can get in, but one approach makes it trivially easy.
Password managers like 1Password, Bitwarden, and Dashlane follow the "locked drawer" approach. They keep your vault encrypted on disk and only decrypt individual entries when you specifically request them. Edge's approach is the equivalent of copying your entire password book into a visible binder on your desk every time you sit down — even if you never look at it.
How Edge Compares to Chrome and Firefox
The vulnerability researcher tested multiple browsers to check whether this behavior was standard across Chromium-based browsers. It wasn't. Here's how they stack up:
| Aspect | Chrome | Edge | Firefox |
|---|---|---|---|
| Password decryption timing | On-demand (only when autofill fires or you open password manager) | All credentials decrypted at startup | Does not load full vault at launch |
| Key protection | App-Bound Encryption (since Chrome 127, 2024) ties keys to the browser process | No key binding — credentials readable by any same-user process | Primary password provides additional encryption layer |
| Memory exposure | Minimal and transient | Full vault, persistent for entire session | Variable — less exposed but not perfect |
ThreatLocker's analysis captured the key difference well: "The distinction between browsers isn't whether credentials end up in memory at some point. It's how much of the vault is exposed, for how long, and how aggressively the keys are protected. Edge currently sits at one end of that spectrum." In our view, that's a diplomatic way of saying Edge is the worst offender by a significant margin.
Who Can Actually Steal Edge Passwords?
Let's get specific about the attack paths so you can judge the risk for yourself.
Infostealer Malware (The Most Likely Threat)
Infostealers are exactly what they sound like: malware designed to steal information. They're sold as subscription services on cybercrime forums — you pay $200, get a dashboard, and point the malware at whatever target you want. The 2025 infostealer credential haul of 1.8 billion came from exactly this kind of operation, according to cyber intelligence firm KELA cited by Forbes. With Edge's design, infostealers don't even need to wait for you to enter a password — they just read the memory dump.
Shared and Enterprise Workstations
This is where the risk amplifies significantly. On a shared computer — a family PC, a university lab, a corporate terminal server — an attacker who gains administrative access can read the memory of every Edge process, including other users' disconnected sessions. ThreatLocker demonstrated this exact scenario: a proof-of-concept video shows simultaneous credential extraction from two separate user accounts logged into the same machine.
Malicious Browser Extensions
A surprising number of malicious or data-hungry extensions make it through browser stores. We've covered the risks of shady extensions before in our security guides, but the Edge plaintext issue makes it worse. A compromised extension running in the same user context can potentially read browser process memory without triggering any security warnings.
What Microsoft Said — and What It Didn't Say
When asked about the discovery, Microsoft confirmed the behavior is intentional. The company told PCWorld and other outlets that Edge's design speeds up the sign-in process and improves the user experience. What Microsoft didn't say is how many users this affects, whether a fix is planned, or why none of its competitors — including Google's Chrome, which shares the same codebase — chose this same design.
We reached out to several password manager vendors for their take. The consensus: this is exactly the kind of security gap that dedicated password managers are designed to prevent. If you're using Edge's built-in password manager, your credentials are no safer than the weakest software running alongside your browser.
How to Protect Yourself Right Now
Here are the steps we recommend, in order of impact:
- Stop using Edge's built-in password manager immediately. Go to edge://settings/passwords and review what's saved there. Then migrate to a dedicated password manager.
- Delete all saved passwords from Edge. After migration, clear the stored passwords from Edge's settings. This removes the plaintext vault from memory entirely.
- Use a dedicated password manager. Options like Bitwarden (free, open-source), 1Password, or Dashlane keep your vault encrypted and only decrypt credentials on demand. Most of them also include built-in password generators that create stronger passwords than you'd come up with on your own.
- Enable strong antivirus or endpoint protection. Infostealers are the primary threat here. Good endpoint detection can catch them before they dump your browser memory.
- Limit administrative privileges on shared computers. If you share a computer with family members or coworkers, use standard user accounts — not admin accounts — for everyday use.
If you're an IT administrator managing multiple machines, consider reviewing our enterprise security guides for detailed configuration recommendations, including group policy settings that can block Edge from saving passwords altogether.
What About Other Browsers?
The researcher who discovered this tested multiple Chromium-based browsers. Edge was the only one with this behavior. Chrome's App-Bound Encryption, introduced in Chrome 127 back in 2024, ties credential decryption keys to the Chrome process itself, making them significantly harder for other software to access. Firefox offers a separate master password feature that adds an additional layer of encryption before credentials ever enter memory.
If you're evaluating whether to switch browsers based on this finding, consider these factors:
- Chrome and Firefox both decrypt on-demand rather than pre-loading
- Chrome's App-Bound Encryption makes it harder for infostealers to extract credentials
- Firefox's master password adds an authentication layer even for local access
- No browser-based password manager is as secure as a dedicated one — but Edge is currently the weakest by a clear margin
The Bigger Picture: 2026 Password Security
This discovery comes at a time when password security is already under intense scrutiny. The 2026 NIST password guidelines shifted focus away from arbitrary complexity requirements toward length and memorability — updates that directly respond to how users actually behave. Meanwhile, the 2026 Verizon Data Breach Investigations Report shows that 81% of hacking-related breaches still involve stolen or weak credentials.
The Edge plaintext passwords issue doesn't change those fundamentals. But it does highlight a crucial point: the security of your passwords depends not just on how strong they are, but where and how they're stored. A 20-character random password generated with our free password generator is still virtually uncrackable. But if it's stored in Edge's always-decrypted vault, a $200 infostealer subscription can scoop it up regardless of how strong it is.
That's why we recommend thinking about password security as a chain: strong generation, unique passwords per site, secure storage in a dedicated manager, and multi-factor authentication as a safety net. Break any link, and the whole chain weakens.
FAQs: Microsoft Edge Password Security
Does Microsoft Edge store passwords in plaintext on disk?
No. Edge encrypts passwords on disk using Windows Data Protection API (DPAPI). The problem is that Edge decrypts them into plaintext in the computer's RAM at startup and keeps them there. Encryption on disk doesn't help if the decrypted version sits exposed in memory.
Can someone steal my Edge passwords remotely?
Not directly — the attacker needs some form of code execution on your machine first. The typical chain is: a phishing email tricks you into downloading malware, the malware runs on your system, and then it reads Edge's process memory. So the risk is real but requires an initial compromise to exploit.
Does this affect Microsoft Edge on Mac or Linux?
Yes. The behavior is part of Edge's password manager implementation, not Windows-specific. If you use Edge on any platform and have saved passwords, they're loaded into plaintext memory at startup.
Is Chrome's password manager safer than Edge's?
Yes, based on the available evidence. Chrome uses App-Bound Encryption and only decrypts passwords on demand rather than at startup. Multiple security researchers have confirmed that Edge is the only Chromium-based browser with this plaintext pre-loading behavior.
Should I stop using Edge entirely?
Not necessarily — Edge is still a capable browser. But we strongly recommend switching to a dedicated password manager like Bitwarden, 1Password, or Dashlane, and deleting all saved passwords from Edge's built-in manager. You can continue using Edge as your browser without using its password storage feature.
Will Microsoft fix this?
Microsoft has stated the behavior is "by design," which suggests no immediate fix is coming. Security researchers and password manager vendors are urging the company to reconsider, but as of May 2026, there's no public timeline for a change.
How do I export my passwords from Edge?
Go to edge://settings/passwords, click the three-dot menu next to "Saved Passwords," and select "Export passwords." You'll need to authenticate with your Windows password or biometrics. The exported CSV file can be imported into most dedicated password managers.
Does using a dedicated password manager in Edge bypass this issue?
Yes. If you install a standalone password manager (like Bitwarden or 1Password) and disable Edge's built-in password saving, the vulnerable plaintext vault never gets created. The dedicated manager handles encryption itself using its own secure architecture.
This is a developing story. We'll update this article as Microsoft responds and as more security researchers analyze the implications. In the meantime, the safest move is clear: stop storing passwords in Edge and switch to a dedicated password manager today.
If you are concerned about how your browser stores passwords, a dedicated password manager combined with a security suite like Kaspersky Premium provides encrypted storage, breach monitoring, and real-time threat protection that browser-native solutions lack.
