Password Manager: Difference between revisions

From MozillaZine Knowledge Base
Jump to navigationJump to search
(→‎Printing passwords: some code cleanup)
(updated for Firefox 32, removed screenshot and outdated info)
 
(8 intermediate revisions by 4 users not shown)
Line 4: Line 4:


You can also choose to use a [[Master password]] to protect your passwords, which is highly recommended if you share your computer.  See the linked article  for details.
You can also choose to use a [[Master password]] to protect your passwords, which is highly recommended if you share your computer.  See the linked article  for details.
Some websites offer to keep you logged in by clicking a check box on the site.  Some websites will also log you in automatically the next time if you do not log out before closing the browser.[http://forums.mozillazine.org/viewtopic.php?p=13386563#p13386563] These are features of the website, and will work whether or not you have saved your username and password with Firefox.


== Using the Password Manager ==
== Using the Password Manager ==
{{right-pic|FxShowPW.png}}
You access the Password Manager from the Firefox menu via "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords".
You access the Password Manager from the Firefox menu via "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords".
*'''Firefox 3:'''  Click the "Saved Passwords" button to open the "Saved Passwords" window.
*Click the "Saved Passwords" button to open the "Saved Passwords" window. The "Saved Passwords" window lists the web sites and user names for your stored passwords and includes a "Show Passwords" button that lets you view your stored passwords.  
*'''Firefox 2:''' Click the "Show Passwords" button to open the "Remember Passwords" window.
The "Saved Passwords" window (Firefox 3) or "Remember Passwords" window (Firefox 2) lists the web sites and user names for your stored passwords and includes a "Show Passwords" button that lets you view your stored passwords.  


If you use a Master password then Firefox has access to the passwords as long as you are logged in to the ''Software Security Device'' ("[[Menu differences in Windows, Linux, and Mac|Tools > Options]] > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). See the [[Master password]] article for details.
If you use a Master password then Firefox has access to the passwords as long as you are logged in to the ''Software Security Device'' ("[[Menu differences in Windows, Linux, and Mac|Tools > Options]] > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). See the [[Master password]] article for details.


=== Deleting passwords ===
=== Deleting passwords ===
To delete stored passwords for web sites and user names listed in the Password Manager, open the "Saved Passwords"  or "Remember Passwords" window ([[#Using the Password Manager|see above]]).  Highlight (select) the items that you want to delete and click the "Remove" button (or press the ''Delete'' key).  '''Warning:'''  Make sure you do not click the "Remove All" button, as that will remove all the passwords,  without asking for confirmation in Firefox 2 and below.
To delete stored passwords for web sites and user names listed in the Password Manager, open the "Saved Passwords" window ([[#Using the Password Manager|see above]]).  Highlight (select) the items that you want to delete and click the "Remove" button (or press the ''Delete'' key).  '''Warning:'''  Make sure you do not click the "Remove All" button, as that will remove all the passwords,  without asking for confirmation in Firefox 2 and below.


=== Exceptions ===
=== Exceptions ===
The Exceptions button in "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords" opens a window ("Exceptions - Saved Passwords" in Firefox 3 or "Don't Remember Passwords" in Firefox 2) that lists the web domains from which you chose never to store passwords.  If you later decide that you do want to store a password from a site on the Exceptions list,  you will need to remove that entry.  That is done in the same way you would delete a password, by highlighting the entry and clicking the "Remove" button (or pressing the ''Delete'' key).
The Exceptions button in "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Security / Passwords" opens a window that lists the web domains from which you chose never to store passwords.  If you later decide that you do want to store a password from a site on the Exceptions list,  you will need to remove that entry.  That is done in the same way you would delete a password, by highlighting the entry and clicking the "Remove" button (or pressing the ''Delete'' key).


== Troubleshooting ==
== Troubleshooting ==
If Firefox 3.5 or later versions do not offer to store new passwords then make sure that you are not in Private Browsing mode. This is the case if you have a "Tools > Stop Private Browsing" menu item. If that item is disabled (grayed) then you start Firefox automatically in Private Browsing mode. To see all the history settings choose [[Menu_differences|Tools -> Options]] > Privacy, choose the setting ''"Firefox will: '''Use custom settings for history"''' ''. You will enter Private Browsing mode if you select: [[Menu_differences|Tools -> Options]] > Privacy > History: ''Firefox will: "Never Remember History"''.
If Firefox 3.5 or later versions do not offer to store new passwords then make sure that you are not in Private Browsing mode. This is the case if you have a "Tools > Stop Private Browsing" menu item. If that item is disabled (grayed) then you start Firefox automatically in Private Browsing mode. To see all the history settings choose [[Menu_differences|Tools -> Options]] > Privacy, choose the setting ''"Firefox will: '''Use custom settings for history"''' ''. You will enter Private Browsing mode if you select: [[Menu_differences|Tools -> Options]] > Privacy > History: ''Firefox will: "Never Remember History"''.


If you do not see any passwords in the Password Manager window (Show Passwords) then your passwords are probably lost.
If you do not see any passwords in the Password Manager window (Show Passwords) then your passwords are probably lost. Firefox 3.5 and later versions, up to and including Firefox 31,  use the file [[signons.sqlite]] to store the encrypted names and passwords. You can rename signons.sqlite to ''signons.sqlite.sav'' to make Firefox 3.5+ versions use the file ''signons#.txt'' from a previous Firefox version. Firefox 3.5 will use an existing ''signons#.txt'' if no signons.sqlite file is present in the [[Profile folder - Firefox|Firefox profile folder]]. All Firefox versions use the same [[key3.db]] file to store the encryption key and that file need to match the signons file.  
If you use Firefox 3 and still see encrypted names and passwords in the file [[signons3.txt]] ([[signons2.txt]] in Firefox 2.0.0.x) then a possible cause is a wrong or corrupted [[key3.db]] file. In Firefox 3.0.2 and 3.0.3 it can also be a problem with the encoding [https://bugzilla.mozilla.org/show_bug.cgi?id=454708#c26][https://bugzilla.mozilla.org/show_bug.cgi?id=454708#c39][http://forums.mozillazine.org/viewtopic.php?f=9&t=868655].<br>
 
If you have updated from ''Firefox 2'' to ''Firefox 3'' and you haven't changed the Master Password then you can try to copy or rename an existing ''signons2.txt'' to ''signons3.txt'' to see if that works.<br />
If you can't add new passwords but still see your old passwords in the Password Manager window then use the [[#Backing_up_and_restoring_passwords|Password Exporter]] extension to export your current passwords and delete key3.db and delete or rename signons.sqlite and all signons#.txt files (e.g. signons3.txt) in the [[Profile folder - Firefox]]. You can also do that if you lost your Master password and the suggestions in the [[Master password]] article didn't work. You need to set a new Master password after deleting the key3.db file.
Firefox 3.5 and later versions use the file [[signons.sqlite]] to store the encrypted names and passwords. You can rename '''signons.sqlite''' to ''signons.sqlite.sav'' to make Firefox 3.5+ versions use the file ''signons#.txt'' from a previous Firefox 3 or 2 version.<br>
 
Firefox 3.5 will use an existing ''signons#.txt'' if no file '''signons.sqlite''' is present in the [[Profile folder - Firefox|Firefox profile folder]].<br>
Starting in Firefox 32, signons.sqlite is no longer used and the file [[logins.json]] is used instead. You can try to force Firefox to re-import the passwords from the signons.sqlite file.  First,  reset the '''signon.importedFromSqlite''' preference on the [[about:config]] page to the default value, via the right-click context menu.  Next, delete the "logins.json" file in the Firefox profile folder with Firefox closed.  When you restart Firefox, you should have the signon.importedFromSqlite preference with the value set to "true" and you should have the passwords imported in the Password Manager, unless there may have been errors. [https://support.mozilla.org/en-US/questions/1006123] [https://bugzilla.mozilla.org/show_bug.cgi?id=925101] [https://bugzilla.mozilla.org/show_bug.cgi?id=853549#c60]
All Firefox versions use the same ''key3.db'' file to store the encryption key and that file need to match the signons file.<br />
If you can't add new passwords but still see your old passwords in the Password Manager window then use the [[#Backing_up_and_restoring_passwords|Password Exporter]] extension to export your current passwords and delete [[key3.db]] and delete or rename [[signons.sqlite]] and all signons#.txt files (e.g. signons3.txt and signons2.txt) in the [[Profile folder - Firefox]]. You can also do that if you lost your Master password and the suggestions in the [[Master password]] article didn't work. You need to set a new Master password after deleting the file ''key3.db''.


== Backing up and restoring passwords ==
== Backing up and restoring passwords ==
Firefox stores your password data in two files: [[key3.db]] (Master Password / Encryption key) and a "signons" file (encrypted names and passwords).  You can backup your passwords by making a copy of the files "key3.db" and "signons" for your Firefox version. Firefox 2 uses [[signons2.txt]]. Firefox 3.0.x uses [[signons3.txt]]. Firefox 3.5 and later versions, including current beta and nightly builds, use [[signons.sqlite]].  [https://bugzilla.mozilla.org/show_bug.cgi?id=288040]<br>
Firefox stores your password data in two files: [[key3.db]] (Master Password / Encryption key) and a "signons" file (encrypted names and passwords).  You can back up your passwords by making a copy of the files "key3.db" and "signons" for your Firefox version. Firefox 3.5 and later versions use '''signons.sqlite'''.  [https://bugzilla.mozilla.org/show_bug.cgi?id=288040] Starting in Firefox 32.0,  the '''logins.json''' file is used instead. See [[Profile folder - Firefox]] and [[Profile backup]] for additional information.
See [[Profile folder - Firefox]] and [[Profile backup]] for additional information.


You can also use the [https://addons.mozilla.org/en-US/firefox/addon/2848 Password Exporter] or [https://addons.mozilla.org/en-US/firefox/addon/2109/ FEBE] add-ons to back up your passwords.
You can use the [https://addons.mozilla.org/firefox/addon/2848 Password Exporter] or [https://addons.mozilla.org/firefox/addon/2109/ FEBE] add-ons to back up your passwords.


You can also create a backup in JSON format with the code shown below. Copy and paste the code in the Code field in the Tools > Error Console and click the Evaluate button<pre>
'''''Note:''' The following information was written for older versions of Firefox.  Starting in Firefox 24,  The Error Console became the Browser Console.  Starting in Firefox 30.0 the Browser Console command line is disabled by default. For more information, see [https://developer.mozilla.org/en-US/docs/Tools/Browser_Console#Browser_Console_command_line this MDN document].''
 
You can also create a backup in JSON format with the code shown below. Copy and paste the code in the Code field in the Tools > Error Console and click the Evaluate button.
<pre>
(function(){
(function(){
var Cc = Components.classes;
var {classes:Cc, interfaces:Ci} = Components;
var Ci = Components.interfaces;


netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
var tokendb = Cc["@mozilla.org/security/pk11tokendb;1"]
var tokendb = Cc["@mozilla.org/security/pk11tokendb;1"]
                 .createInstance(Ci.nsIPK11TokenDB);
                 .createInstance(Ci.nsIPK11TokenDB);
var token = tokendb.getInternalKeyToken();
var token = tokendb.getInternalKeyToken();


try { token.login(true);} catch (e) { }
try { token.login(true); } catch (e) { }


if (token.isLoggedIn()) {
if (!token.needsLogin() || token.isLoggedIn()) {
  var passwordmanager = Cc["@mozilla.org/login-manager;1"]
  var passwordmanager = Cc["@mozilla.org/login-manager;1"]
                         .getService(Ci.nsILoginManager);
                         .getService(Ci.nsILoginManager);
Line 67: Line 63:
  }
  }


  var json =Cc["@mozilla.org/dom/json;1"]
  var json = JSON.stringify(signons);
  .createInstance(Ci.nsIJSON)
  .encode(signons);


  var fp=Cc["@mozilla.org/filepicker;1"]
  var fp=Cc["@mozilla.org/filepicker;1"]
Line 88: Line 82:
</pre>
</pre>


== Printing passwords ==
If you want a printed copy of the password then look at [http://forums.mozillazine.org/viewtopic.php?t=618060 this forum thread] and also read [http://edmullen.net/Mozilla/moz_pw.php this web page] (scroll down to #4).<br/>
This is the Firefox 3 version of the code from the [http://edmullen.net/Mozilla/display_moz_passwords.html edmullen's site]. You can find the complete file with the Firefox 3 code on: [http://the-edmeister.com/firefox_info/Firefox_Passwords_Info.html the-edmeister's Firefox Informational Website].
The version shown below will run in the Tools > Error Console (paste the code in the Code field and click the Evaluate button)
<pre>
(function(){ /* kb.mozillazine.org */
function twodigs(str) {return (str.length < 2) ? "0" + str : str;}
var now = new Date();
var hours = twodigs(now.getHours() + "") ;
var minutes = twodigs(now.getMinutes() + "") ;
var seconds = twodigs(now.getSeconds() + "") ;
var timeValue = " - At  " + hours + ":" + minutes + ":" + seconds;
var days = new Array("Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday");
var months = new Array("January","February","March","April","May","June","July","August","September","October","November","December");
var date = ((now.getDate()<10) ? "0" : "")+ now.getDate();
var today =  "On " + days[now.getDay()] + ", " + date + " " + months[now.getMonth()] + " " + now.getYear() + timeValue ;
var Cc = Components.classes;
var Ci = Components.interfaces;
var tokendb = Cc["@mozilla.org/security/pk11tokendb;1"].createInstance(Ci.nsIPK11TokenDB);
var token = tokendb.getInternalKeyToken();
try {token.login(true);} catch (e) {}
if (!token.needsLogin()||token.isLoggedIn()){
var pwdmanager = Cc["@mozilla.org/login-manager;1"].getService(Ci.nsILoginManager);
var names="",signons = pwdmanager.getAllLogins({});
for (i=0;i<signons.length;i++) {
  try {
  var host = signons[i].hostname;
  var realm = signons[i].httpRealm;
  var user = signons[i].username;
  var userf = signons[i].usernameField;
  var password = signons[i].password;
  var passwordf = signons[i].passwordField;
  var submiturl = signons[i].formSubmitURL;
  if (user == ""){ user = "<br>"; }
  names+="<tr><td>" + host + "<td>" + user + "<td>" + password + "<td>" + submiturl;
  } catch(e) {}
}
void(window.open('data:text/html;charset=utf-8,
<html><head>
<meta http-equiv="content-type" content="text/html">
<title>Exported Mozilla Passwords</title>
<style type="text/css">
body {
  margin: 1em 3em;
  background-color: rgb(255, 221, 221);
}
table {
  empty-cells: show;
  background-color: rgb(221, 255, 221);
}
tr.head {
  background-color: rgb(204, 204, 255);
}
td {
  font-family: "Trebuchet MS", Arial, Verdana, Sans-Serif;
  font-size: 85%;
  padding: 1px 2px 1px 2px;
}
</style>
</head><body>
<b>MOZILLA PASSWORD INFORMATION</b>
<p>Produced by <i>Pasting Code in the "Tools > Error Console: Code field"</i> (by "ernie" - Andrew Poth - Ed Mullen - adapted by dickvl@kb.mozillazine.org to run in the Error Console)<br>'+today+
'</p><p>
<table border="1" cellspacing="0">
<tr class="head">
<td><b>Host</b>
<td><b>User name</b>
<td><b>Password</b>
<td><b>Submit URL</b>
'+names+'</table>
</p></body></html>',"","menubar=yes,resizable=yes,scrollbars=yes,width=1000,height:600"));
}
})();
</pre>


==Entry of userid and password when requested==
==Entry of userid and password when requested==
Line 178: Line 88:
==See also==
==See also==
* [[User name and password not remembered]]
* [[User name and password not remembered]]
* [[signons.txt]] (Firefox 2.0 and 2.0.0.1 and Firefox 1.5.0.9 and below)


==External links==
==External links==
* [https://addons.mozilla.org/en-US/firefox/addon/2848 Password Exporter] extension
* [https://addons.mozilla.org/firefox/addon/60265/ Saved Password Editor], extension, create and edit password entries
* [http://support.mozilla.com/kb/Remembering+passwords Remembering passwords (Firefox Support)]
* [https://addons.mozilla.org/firefox/addon/2848/ Password Exporter] extension
* [http://support.mozilla.com/kb/Protecting+stored+passwords+using+a+master+password Protecting stored passwords using a master password]
* [https://support.mozilla.org/kb/Remembering+passwords Remembering passwords] (Firefox Support)
* [https://support.mozilla.org/kb/Protecting+stored+passwords+using+a+master+password Protecting stored passwords using a master password] (Firefox Support)


[[Category:Privacy and security]]
[[Category:Privacy and security]]

Latest revision as of 11:07, 29 August 2014

This article was written for Firefox but may also apply to Mozilla Suite/SeaMonkey and Thunderbird, although menu sequences may differ.

Firefox includes a feature that allows you to save passwords. If you enter a password in a web form and you do not see a message asking you if you want Firefox to remember the password, make sure that "Remember passwords for sites" is enabled in "Tools -> Options -> Security / Passwords.

You can also choose to use a Master password to protect your passwords, which is highly recommended if you share your computer. See the linked article for details.

Some websites offer to keep you logged in by clicking a check box on the site. Some websites will also log you in automatically the next time if you do not log out before closing the browser.[1] These are features of the website, and will work whether or not you have saved your username and password with Firefox.

Using the Password Manager

You access the Password Manager from the Firefox menu via "Tools -> Options -> Security / Passwords".

  • Click the "Saved Passwords" button to open the "Saved Passwords" window. The "Saved Passwords" window lists the web sites and user names for your stored passwords and includes a "Show Passwords" button that lets you view your stored passwords.

If you use a Master password then Firefox has access to the passwords as long as you are logged in to the Software Security Device ("Tools > Options > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). See the Master password article for details.

Deleting passwords

To delete stored passwords for web sites and user names listed in the Password Manager, open the "Saved Passwords" window (see above). Highlight (select) the items that you want to delete and click the "Remove" button (or press the Delete key). Warning: Make sure you do not click the "Remove All" button, as that will remove all the passwords, without asking for confirmation in Firefox 2 and below.

Exceptions

The Exceptions button in "Tools -> Options -> Security / Passwords" opens a window that lists the web domains from which you chose never to store passwords. If you later decide that you do want to store a password from a site on the Exceptions list, you will need to remove that entry. That is done in the same way you would delete a password, by highlighting the entry and clicking the "Remove" button (or pressing the Delete key).

Troubleshooting

If Firefox 3.5 or later versions do not offer to store new passwords then make sure that you are not in Private Browsing mode. This is the case if you have a "Tools > Stop Private Browsing" menu item. If that item is disabled (grayed) then you start Firefox automatically in Private Browsing mode. To see all the history settings choose Tools -> Options > Privacy, choose the setting "Firefox will: Use custom settings for history" . You will enter Private Browsing mode if you select: Tools -> Options > Privacy > History: Firefox will: "Never Remember History".

If you do not see any passwords in the Password Manager window (Show Passwords) then your passwords are probably lost. Firefox 3.5 and later versions, up to and including Firefox 31, use the file signons.sqlite to store the encrypted names and passwords. You can rename signons.sqlite to signons.sqlite.sav to make Firefox 3.5+ versions use the file signons#.txt from a previous Firefox version. Firefox 3.5 will use an existing signons#.txt if no signons.sqlite file is present in the Firefox profile folder. All Firefox versions use the same key3.db file to store the encryption key and that file need to match the signons file.

If you can't add new passwords but still see your old passwords in the Password Manager window then use the Password Exporter extension to export your current passwords and delete key3.db and delete or rename signons.sqlite and all signons#.txt files (e.g. signons3.txt) in the Profile folder - Firefox. You can also do that if you lost your Master password and the suggestions in the Master password article didn't work. You need to set a new Master password after deleting the key3.db file.

Starting in Firefox 32, signons.sqlite is no longer used and the file logins.json is used instead. You can try to force Firefox to re-import the passwords from the signons.sqlite file. First, reset the signon.importedFromSqlite preference on the about:config page to the default value, via the right-click context menu. Next, delete the "logins.json" file in the Firefox profile folder with Firefox closed. When you restart Firefox, you should have the signon.importedFromSqlite preference with the value set to "true" and you should have the passwords imported in the Password Manager, unless there may have been errors. [2] [3] [4]

Backing up and restoring passwords

Firefox stores your password data in two files: key3.db (Master Password / Encryption key) and a "signons" file (encrypted names and passwords). You can back up your passwords by making a copy of the files "key3.db" and "signons" for your Firefox version. Firefox 3.5 and later versions use signons.sqlite. [5] Starting in Firefox 32.0, the logins.json file is used instead. See Profile folder - Firefox and Profile backup for additional information.

You can use the Password Exporter or FEBE add-ons to back up your passwords.

Note: The following information was written for older versions of Firefox. Starting in Firefox 24, The Error Console became the Browser Console. Starting in Firefox 30.0 the Browser Console command line is disabled by default. For more information, see this MDN document.

You can also create a backup in JSON format with the code shown below. Copy and paste the code in the Code field in the Tools > Error Console and click the Evaluate button.

(function(){
var {classes:Cc, interfaces:Ci} = Components;

var tokendb = Cc["@mozilla.org/security/pk11tokendb;1"]
                .createInstance(Ci.nsIPK11TokenDB);
var token = tokendb.getInternalKeyToken();

try { token.login(true); } catch (e) { }

if (!token.needsLogin() || token.isLoggedIn()) {
 var passwordmanager = Cc["@mozilla.org/login-manager;1"]
                         .getService(Ci.nsILoginManager);
 var signons = passwordmanager.getAllLogins({});

 for (i=0;i<signons.length;i++) {
  try {
   var host = signons[i].hostname;
   var realm = signons[i].httpRealm;
   var user = signons[i].username;
   var userf = signons[i].usernameField;
   var password = signons[i].password;
   var passwordf = signons[i].passwordField;
   var submiturl = signons[i].formSubmitURL;
   } catch(e) {}
 }

 var json = JSON.stringify(signons);

 var fp=Cc["@mozilla.org/filepicker;1"]
          .createInstance(Components.interfaces.nsIFilePicker);

 fp.init(window,"",Ci.nsIFilePicker.modeSave);
 fp.defaultString="signons.json";
 if (fp.show() == fp.returnCancel) return;

 var filoutputStream=Cc["@mozilla.org/network/file-output-stream;1"]
                       .createInstance(Ci.nsIFileOutputStream);

 filoutputStream.init(fp.file,0x04|0x08,0644,0);
 filoutputStream.write(json,json.length);
 filoutputStream.close();
}
})()


Entry of userid and password when requested

If the password is stored, you can start typing in the first letter(s) of the userid, or you can double-click in the userid text area, either should bring up a choice of userids. Once the userid is typed in the password will be automatically entered after you have answered request for your Master Password. The Master Password needs to be entered only once for a site during your session. If there is only one choice and you have already entered the master password during your session you may be able to just mouse over the userid.

See also

External links