Password Manager: Difference between revisions

From MozillaZine Knowledge Base
Jump to navigationJump to search
No edit summary
(updated for Firefox 32, removed screenshot and outdated info)
 
(35 intermediate revisions by 6 users not shown)
Line 1: Line 1:
Firefox includes a feature that allows you to save passwords you enter in web forms. This option is enabled by default, under "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords -> Remember passwords for sites".
''This article was written for Firefox but may also apply to Mozilla Suite/SeaMonkey and Thunderbird, although menu sequences may differ.''


Note: You can choose to use a [[Master password]] to protect your passwords, which is highly recommended on a shared computer. See the linked article for details.
Firefox includes a feature that allows you to save passwords.  If you enter a password in a web form and you do not see a message asking you if you want Firefox to remember the password,  make sure that "Remember passwords for sites" is enabled in "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords.


== Accessing the Password Manager ==
You can also choose to use a [[Master password]] to protect your passwords, which is highly recommended if you share your computer.   See the linked article for details.
You can manage your stored passwords using the Password Manager, which you access from the Firefox menu via "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Password", by clicking the "Show Passwords" button. This will open the "Remember Passwords" window which lists the web sites and user names for your stored passwords and includes a "Show Passwords" button that lets you view your stored passwords. If you use a Master password then Firefox has access to the passwords as long as you are logged in to the ''Software Security Device'' ("[[Menu differences in Windows, Linux, and Mac|Tools > Options]] > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). See the [[Master password]] article for details.


== Deleting passwords ==
Some websites offer to keep you logged in by clicking a check box on the site.  Some websites will also log you in automatically the next time if you do not log out before closing the browser.[http://forums.mozillazine.org/viewtopic.php?p=13386563#p13386563] These are features of the website, and will work whether or not you have saved your username and password with Firefox.
You can delete passwords in the Password Manager by clicking the "Show Passwords" button to open the window listing the sites and user names for the remembered passwords. Highlight (select) the items that you want to delete and click the "Remove" button (or press the ''Delete'' key). Be sure not to click the "Remove All" button as that will remove all the passwords without asking for confirmation in Firefox 2 and below.


== Exceptions ==
== Using the Password Manager ==
The Exceptions button opens a window ("Don't Remember Passwords") that lists the web domains from which you chose never to store passwords. If you later decide later that you do want to store a password from a site on the Exceptions list,  you need to remove that entry. That is done in the same way you would delete a password, by highlighting the entry and clicking the "Remove" button (or pressing the ''Delete'' key).
You access the Password Manager from the Firefox menu via "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords".
*Click the "Saved Passwords" button to open the "Saved Passwords" window.  The "Saved Passwords" window  lists the web sites and user names for your stored passwords and includes a "Show Passwords" button that lets you view your stored passwords.  


== Backup and restore passwords ==
If you use a Master password then Firefox has access to the passwords as long as you are logged in to the ''Software Security Device'' ("[[Menu differences in Windows, Linux, and Mac|Tools > Options]] > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). See the [[Master password]] article for details.
You can make a backup copy of [[key3.db]] (Master Password / Encryption key) and [[signons2.txt]] (encrypted names and passwords). Firefox 3 will use [[signons3.txt]] to store the passwords. See: [[Profile folder - Firefox]] and [[Profile backup]] for additional information.


You can also use the [https://addons.mozilla.org/en-US/firefox/addon/2848 Password Exporter extension] to back up your passwords.
=== Deleting passwords ===
To delete stored passwords for web sites and user names listed in the Password Manager, open the "Saved Passwords" window ([[#Using the Password Manager|see above]]).  Highlight (select) the items that you want to delete and click the "Remove" button (or press the ''Delete'' key).  '''Warning:'''  Make sure you do not click the "Remove All" button, as that will remove all the passwords,  without asking for confirmation in Firefox 2 and below.


== Printing passwords ==
=== Exceptions ===
If you want a printed copy of the password then look at [http://forums.mozillazine.org/viewtopic.php?t=618060 this forum thread] and also read [http://edmullen.net/Mozilla/moz_pw.php this web page] (scroll down to #4).<br/>
The Exceptions button in "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords" opens a window that lists the web domains from which you chose never to store passwords.  If you later decide that you do want to store a password from a site on the Exceptions list,  you will need to remove that entry.  That is done in the same way you would delete a password, by highlighting the entry and clicking the "Remove" button (or pressing the ''Delete'' key).


This is the Firefox 3 replacement code (table header and JavaScript) for the code of [http://edmullen.net/Mozilla/display_moz_passwords.html edmullen's site]. <pre>
== Troubleshooting ==
<table style="empty-cells: show; background-color: rgb(221, 255, 221);" border="1" cellspacing="0">
If Firefox 3.5 or later versions do not offer to store new passwords then make sure that you are not in Private Browsing mode. This is the case if you have a "Tools > Stop Private Browsing" menu item. If that item is disabled (grayed) then you start Firefox automatically in Private Browsing mode. To see all the history settings choose [[Menu_differences|Tools -> Options]] > Privacy, choose the setting ''"Firefox will: '''Use custom settings for history"''' ''. You will enter Private Browsing mode if you select: [[Menu_differences|Tools -> Options]] > Privacy > History: ''Firefox will: "Never Remember History"''.
<tbody><tr style="background-color: rgb(204, 204, 255);">
 
<td>
If you do not see any passwords in the Password Manager window (Show Passwords) then your passwords are probably lost.  Firefox 3.5 and later versions, up to and including Firefox 31,  use the file [[signons.sqlite]] to store the encrypted names and passwords. You can rename signons.sqlite to ''signons.sqlite.sav'' to make Firefox 3.5+ versions use the file ''signons#.txt'' from a previous Firefox version. Firefox 3.5 will use an existing ''signons#.txt'' if no signons.sqlite file is present in the [[Profile folder - Firefox|Firefox profile folder]].  All Firefox versions use the same [[key3.db]] file to store the encryption key and that file need to match the signons file.
<b>Host</b>
 
</td>
If you can't add new passwords but still see your old passwords in the Password Manager window then use the [[#Backing_up_and_restoring_passwords|Password Exporter]] extension to export your current passwords and delete key3.db and delete or rename signons.sqlite and all signons#.txt files (e.g. signons3.txt) in the [[Profile folder - Firefox]]. You can also do that if you lost your Master password and the suggestions in the [[Master password]] article didn't work. You need to set a new Master password after deleting the key3.db file.
<td>
 
<b>User name</b>
Starting in Firefox 32, signons.sqlite is no longer used and the file [[logins.json]] is used instead. You can try to force Firefox to re-import the passwords from the signons.sqlite file.  First,  reset the '''signon.importedFromSqlite''' preference on the [[about:config]] page to the default value, via the right-click context menu.  Next, delete the "logins.json" file in the Firefox profile folder with Firefox closed.  When you restart Firefox, you should have the signon.importedFromSqlite preference with the value set to "true" and you should have the passwords imported in the Password Manager, unless there may have been errors. [https://support.mozilla.org/en-US/questions/1006123] [https://bugzilla.mozilla.org/show_bug.cgi?id=925101] [https://bugzilla.mozilla.org/show_bug.cgi?id=853549#c60]
</td>
 
<td>
== Backing up and restoring passwords ==
<b>Password</b>
Firefox stores your password data in two files: [[key3.db]] (Master Password / Encryption key) and a "signons" file (encrypted names and passwords).  You can back up your passwords by making a copy of the files "key3.db" and "signons" for your Firefox version.  Firefox 3.5 and later versions use '''signons.sqlite'''.  [https://bugzilla.mozilla.org/show_bug.cgi?id=288040]  Starting in Firefox 32.0, the '''logins.json''' file is used instead. See [[Profile folder - Firefox]] and [[Profile backup]] for additional information.
</td>
 
<td>
You can use the [https://addons.mozilla.org/firefox/addon/2848 Password Exporter] or [https://addons.mozilla.org/firefox/addon/2109/ FEBE] add-ons to back up your passwords.
<b>Submit URL</b>
 
</td>
'''''Note:''' The following information was written for older versions of Firefox.  Starting in Firefox 24,  The Error Console became the Browser Console.  Starting in Firefox 30.0 the Browser Console command line is disabled by default. For more information, see [https://developer.mozilla.org/en-US/docs/Tools/Browser_Console#Browser_Console_command_line this MDN document].''
</tr>
 
You can also create a backup in JSON format with the code shown below. Copy and paste the code in the Code field in the Tools > Error Console and click the Evaluate button.
<pre>
(function(){
var {classes:Cc, interfaces:Ci} = Components;
 
var tokendb = Cc["@mozilla.org/security/pk11tokendb;1"]
                .createInstance(Ci.nsIPK11TokenDB);
var token = tokendb.getInternalKeyToken();
 
try { token.login(true); } catch (e) { }


<script type="text/javascript"> // modified by dickvl for Firefox 3
if (!token.needsLogin() || token.isLoggedIn()) {
<!--
var passwordmanager = Cc["@mozilla.org/login-manager;1"]
  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
                        .getService(Ci.nsILoginManager);
  var passwordmanager = Components.classes["@mozilla.org/login-manager;1"]
var signons = passwordmanager.getAllLogins({});
.getService(Components.interfaces.nsILoginManager);
  // loads signons into table
  var signons = passwordmanager.getAllLogins({});
  for (i=0;i<signons.length;i++) {
  try {
      var host = signons[i].hostname;
      var user = signons[i].username;
      var password = signons[i].password;
      var submiturl = signons[i].formSubmitURL;
      if (user == ""){user = "<br>";}
      document.write("  <tr>\n    <td> " + host + " </td>\n    <td> " + user + " </td>\n    <td> " +
password + "  </td>\n    <td> " + submiturl + " </td>\n  </tr>\n");
    } catch(e) {
      /* An entry is corrupt. Go to next element. */
    }
  }
-->
</script>
</tbody></table></pre>


== Troubleshooting ==
for (i=0;i<signons.length;i++) {
If you do not see any passwords in the Password Manager window (Show Passwords) then your passwords are probably lost.
  try {
If you still see encrypted names and passwords in the file [[signons2.txt]] then the likely cause is a wrong or corrupted [[key3.db]] file.
  var host = signons[i].hostname;
If you can't add new passwords but still see your old passwords in the Password Manager window then use the Password Exporter extension to export your current passwords and delete both [[key3.db]] and [[signons2.txt]] in the [[Profile folder]]. You can also do that if you lost your Master password and [[Master password]] didn't work. You need to set a new Master password after deleting the file ''key3.db''.
  var realm = signons[i].httpRealm;
  var user = signons[i].username;
  var userf = signons[i].usernameField;
  var password = signons[i].password;
  var passwordf = signons[i].passwordField;
  var submiturl = signons[i].formSubmitURL;
  } catch(e) {}
}
 
var json = JSON.stringify(signons);
 
var fp=Cc["@mozilla.org/filepicker;1"]
          .createInstance(Components.interfaces.nsIFilePicker);
 
fp.init(window,"",Ci.nsIFilePicker.modeSave);
fp.defaultString="signons.json";
if (fp.show() == fp.returnCancel) return;
 
var filoutputStream=Cc["@mozilla.org/network/file-output-stream;1"]
                      .createInstance(Ci.nsIFileOutputStream);
 
filoutputStream.init(fp.file,0x04|0x08,0644,0);
filoutputStream.write(json,json.length);
filoutputStream.close();
}
})()
</pre>
 
 
==Entry of userid and password when requested==
If the password is stored,  you can start typing in the first letter(s) of the userid,  or you can double-click in the userid text area, either should bring up a choice of userids. Once the userid is typed in the password will be automatically entered after you have answered request for your Master Password.  The Master Password needs to be entered only once for a site during your session.  If there is only one choice and you have already entered the master password during your session you may be able to just mouse over the userid.


==See also==
==See also==
* [[signons.txt]] (Firefox 2.0 and 2.0.0.1 and Firefox 1.5.0.9 and below)
* [[User name and password not remembered]]
* [[signons3.txt]] (Firefox 3)


==External links==
==External links==
* [https://addons.mozilla.org/en-US/firefox/addon/2848 Password Exporter] extension.
* [https://addons.mozilla.org/firefox/addon/60265/ Saved Password Editor], extension, create and edit password entries
* [https://addons.mozilla.org/firefox/addon/2848/ Password Exporter] extension
* [https://support.mozilla.org/kb/Remembering+passwords Remembering passwords] (Firefox Support)
* [https://support.mozilla.org/kb/Protecting+stored+passwords+using+a+master+password Protecting stored passwords using a master password] (Firefox Support)


[[Category:Privacy and security]]
[[Category:Privacy and security]]

Latest revision as of 11:07, 29 August 2014

This article was written for Firefox but may also apply to Mozilla Suite/SeaMonkey and Thunderbird, although menu sequences may differ.

Firefox includes a feature that allows you to save passwords. If you enter a password in a web form and you do not see a message asking you if you want Firefox to remember the password, make sure that "Remember passwords for sites" is enabled in "Tools -> Options -> Security / Passwords.

You can also choose to use a Master password to protect your passwords, which is highly recommended if you share your computer. See the linked article for details.

Some websites offer to keep you logged in by clicking a check box on the site. Some websites will also log you in automatically the next time if you do not log out before closing the browser.[1] These are features of the website, and will work whether or not you have saved your username and password with Firefox.

Using the Password Manager

You access the Password Manager from the Firefox menu via "Tools -> Options -> Security / Passwords".

  • Click the "Saved Passwords" button to open the "Saved Passwords" window. The "Saved Passwords" window lists the web sites and user names for your stored passwords and includes a "Show Passwords" button that lets you view your stored passwords.

If you use a Master password then Firefox has access to the passwords as long as you are logged in to the Software Security Device ("Tools > Options > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). See the Master password article for details.

Deleting passwords

To delete stored passwords for web sites and user names listed in the Password Manager, open the "Saved Passwords" window (see above). Highlight (select) the items that you want to delete and click the "Remove" button (or press the Delete key). Warning: Make sure you do not click the "Remove All" button, as that will remove all the passwords, without asking for confirmation in Firefox 2 and below.

Exceptions

The Exceptions button in "Tools -> Options -> Security / Passwords" opens a window that lists the web domains from which you chose never to store passwords. If you later decide that you do want to store a password from a site on the Exceptions list, you will need to remove that entry. That is done in the same way you would delete a password, by highlighting the entry and clicking the "Remove" button (or pressing the Delete key).

Troubleshooting

If Firefox 3.5 or later versions do not offer to store new passwords then make sure that you are not in Private Browsing mode. This is the case if you have a "Tools > Stop Private Browsing" menu item. If that item is disabled (grayed) then you start Firefox automatically in Private Browsing mode. To see all the history settings choose Tools -> Options > Privacy, choose the setting "Firefox will: Use custom settings for history" . You will enter Private Browsing mode if you select: Tools -> Options > Privacy > History: Firefox will: "Never Remember History".

If you do not see any passwords in the Password Manager window (Show Passwords) then your passwords are probably lost. Firefox 3.5 and later versions, up to and including Firefox 31, use the file signons.sqlite to store the encrypted names and passwords. You can rename signons.sqlite to signons.sqlite.sav to make Firefox 3.5+ versions use the file signons#.txt from a previous Firefox version. Firefox 3.5 will use an existing signons#.txt if no signons.sqlite file is present in the Firefox profile folder. All Firefox versions use the same key3.db file to store the encryption key and that file need to match the signons file.

If you can't add new passwords but still see your old passwords in the Password Manager window then use the Password Exporter extension to export your current passwords and delete key3.db and delete or rename signons.sqlite and all signons#.txt files (e.g. signons3.txt) in the Profile folder - Firefox. You can also do that if you lost your Master password and the suggestions in the Master password article didn't work. You need to set a new Master password after deleting the key3.db file.

Starting in Firefox 32, signons.sqlite is no longer used and the file logins.json is used instead. You can try to force Firefox to re-import the passwords from the signons.sqlite file. First, reset the signon.importedFromSqlite preference on the about:config page to the default value, via the right-click context menu. Next, delete the "logins.json" file in the Firefox profile folder with Firefox closed. When you restart Firefox, you should have the signon.importedFromSqlite preference with the value set to "true" and you should have the passwords imported in the Password Manager, unless there may have been errors. [2] [3] [4]

Backing up and restoring passwords

Firefox stores your password data in two files: key3.db (Master Password / Encryption key) and a "signons" file (encrypted names and passwords). You can back up your passwords by making a copy of the files "key3.db" and "signons" for your Firefox version. Firefox 3.5 and later versions use signons.sqlite. [5] Starting in Firefox 32.0, the logins.json file is used instead. See Profile folder - Firefox and Profile backup for additional information.

You can use the Password Exporter or FEBE add-ons to back up your passwords.

Note: The following information was written for older versions of Firefox. Starting in Firefox 24, The Error Console became the Browser Console. Starting in Firefox 30.0 the Browser Console command line is disabled by default. For more information, see this MDN document.

You can also create a backup in JSON format with the code shown below. Copy and paste the code in the Code field in the Tools > Error Console and click the Evaluate button.

(function(){
var {classes:Cc, interfaces:Ci} = Components;

var tokendb = Cc["@mozilla.org/security/pk11tokendb;1"]
                .createInstance(Ci.nsIPK11TokenDB);
var token = tokendb.getInternalKeyToken();

try { token.login(true); } catch (e) { }

if (!token.needsLogin() || token.isLoggedIn()) {
 var passwordmanager = Cc["@mozilla.org/login-manager;1"]
                         .getService(Ci.nsILoginManager);
 var signons = passwordmanager.getAllLogins({});

 for (i=0;i<signons.length;i++) {
  try {
   var host = signons[i].hostname;
   var realm = signons[i].httpRealm;
   var user = signons[i].username;
   var userf = signons[i].usernameField;
   var password = signons[i].password;
   var passwordf = signons[i].passwordField;
   var submiturl = signons[i].formSubmitURL;
   } catch(e) {}
 }

 var json = JSON.stringify(signons);

 var fp=Cc["@mozilla.org/filepicker;1"]
          .createInstance(Components.interfaces.nsIFilePicker);

 fp.init(window,"",Ci.nsIFilePicker.modeSave);
 fp.defaultString="signons.json";
 if (fp.show() == fp.returnCancel) return;

 var filoutputStream=Cc["@mozilla.org/network/file-output-stream;1"]
                       .createInstance(Ci.nsIFileOutputStream);

 filoutputStream.init(fp.file,0x04|0x08,0644,0);
 filoutputStream.write(json,json.length);
 filoutputStream.close();
}
})()


Entry of userid and password when requested

If the password is stored, you can start typing in the first letter(s) of the userid, or you can double-click in the userid text area, either should bring up a choice of userids. Once the userid is typed in the password will be automatically entered after you have answered request for your Master Password. The Master Password needs to be entered only once for a site during your session. If there is only one choice and you have already entered the master password during your session you may be able to just mouse over the userid.

See also

External links