Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

andrew129260 · May 5, 2026

https://twitter.com/x/status/2051308329880719730

Researcher shows Edge saves passwords in memory in cleartext, 'even when you're not using them'

You do need admin rights to get that far, though.

www.pcgamer.com

What makes this more frustrating is that edge automatically pulls your passwords and history into it sometimes from other browsers automatically. Making all of them vulnerable as well..

Microsoft's response was this was by design....

Yes storing passwords in the browser isn't the safest we have known that for awhile. But again, why let such easy openings like this? Makes no sense.

One could argue that if a user has admin rights, they can already cause havoc on a rig if they have access, and that's true. But something worth considering is that many PC users will have admin rights on their accounts as a default. And even if you have admin rights, you often have to use passwords to get access to password managers, or even use two-factor authentication. Cleartext saved passwords, as argued by International Cyber Digest, means "in shared environments, this turns into a credential harvest."

Edge is the only affected chromium browser so far. Chrome and others are not affected

I am one of the few people that like windows 11 a lot. But there has been a lot of problems lately where Microsoft is ignoring security issues and saying things are by design so we're not fixing it.

Let others around you know and check on your loved ones machines. Make sure they are not affected

Mark K · May 5, 2026

Copying my response to this thread:

Web browser password managers, Cloud password managers, and local password managers all send credentials decrypted.

Out of all the password managers, web browser password manager, and local password managers I researched, Microsoft Edge is the only one where Microsoft keeps all password information loaded in memory in plain text (decrypted) while NOT being used at all. This "work as design" stupidity from Microsoft shows their carelessness of handling sensitive data.

Google Chrome and many other browsers, based on what I have read so far, only decrypts the password information when used and encrypts it back afterwards. I did not see anything whether other browsers retain this information in memory encrypted or decrypted.

Microsoft Edge worldwide market share is around 11.5% where this should not be to big a problem.

Google Chrome worldwide market share is near 72%.

bikemanAMD · May 5, 2026

Glad i pay for a Roboform Password Manager subscription (paid til 2/2028) and no longer use Edge Password Manager.

I did originally use til i decided to purchase Roboform, as in doing my research didn't see any security breaches or such with Roboform. Unlike LastPass that i researched a little bit prior to picking Roboform

Mark K · May 5, 2026

Finally got a good response from Google Gemini. Microsoft's Copilot answers have changed from this event and seems like Microsoft is forcing Copilot to hide the real answers.

Google Gemini: asked about what browser really protects passwords information in memory (aside from password managers)

Mozilla Firefox offers a distinct architectural advantage over Brave and Google Chrome regarding memory-level security, but this is only effective if you enable the Primary Password feature.

1. The Key Difference: Application-Level vs. OS-Level

The primary concern with Brave and Chrome (both built on Chromium) is that they rely on your Operating System (OS) login to "unlock" your passwords.

Brave & Chrome: Once you are logged into your Windows/macOS account, the browser has "permission" to decrypt your passwords. If you walk away from your desk while logged in, or if malware gains your OS user privileges, the passwords can be pulled into memory in plaintext because the browser assumes you (the authorized user) are the one asking.
Firefox (with Primary Password): Firefox uses its own independent encryption layer. Even if you are logged into your computer, the passwords remain encrypted on your disk AND in your browser's memory until you manually type in your Primary Password.

2. Handling Passwords in Memory (RAM)

In a technical sense, no browser is perfectly "plaintext-proof" once a password is in active use, but their "idle" states differ:

Chromium (Brave/Chrome): Historically, once the browser process is running and the user is authenticated via the OS, the "vault" is essentially open. Credentials can sometimes reside in RAM in a state that memory-scraping malware can target.
Firefox: When you use a Primary Password, Firefox acts more like a dedicated manager (e.g., Bitwarden). 1 It keeps the decryption key itself encrypted. 2 When you close the browser, that "session" key is wiped from memory. To see your passwords again, you must re-enter the Primary Password. 3

Mark K · May 5, 2026

The table did not copy in my reponse:

DarkShadowMD · May 5, 2026

Bitwarden should be unaffected, since they forcibly ask you to establish a master password to use the manager, otherwise, you can't do anything. They also allow you to use 2FA...

Mark K · May 5, 2026

DarkShadowMD said:
Bitwarden should be unaffected, since they forcibly ask you to establish a master password to use the manager, otherwise, you can't do anything. They also allow you to use 2FA...

I wondered that myself. Password information in any password manager will be in memory in plain text format while sent to the web site. However, third-party password manager immediately clears the memory, like Bitwarden, that still are susceptible. There is a very small chance when compared to the alternative methods (nothing is 100% secure):

In 2026, the short answer is yes. While third-party password managers are significantly more secure than browsers, they are not immune to "memory-scraping" malware.
Because a computer must eventually "read" a password to type it into a website, that password must exist in a decrypted state in your RAM (memory) at some point. Modern infostealers (like the Acreed Stealer or the memory-harvesting variants that emerged in late 2025) specifically target these brief moments of decryption.

1. How They Protect You (and Where They Fail)

Most top-tier managers like Bitwarden, 1Password, and Keeper use a "Zero-Knowledge" architecture, but their memory handling differs:

At Rest: Your vault is fully encrypted on your hard drive. Malware cannot simply "copy a file" and read your passwords.
In Memory (Unlocked): When you enter your Master Password, the manager creates a decryption key in your RAM. This key is used to unlock your passwords as you need them.
The Risk: Sophisticated 2026 malware can "dump" the memory of the password manager's process. If your vault is unlocked, the malware may find the master decryption key or individual passwords that were recently accessed.

2. Specific Vulnerabilities in 2026

Recent research has highlighted specific ways third-party managers are targeted:

Process Injection: Malware can inject itself into your browser or password manager process. It then waits for you to "autofill" a password. At that exact millisecond, the password is in plaintext in RAM, and the malware grabs it.
The "Idle" Problem: Some managers are better than others at "zeroing out" memory. For example, Bitwarden explicitly states it attempts to purge sensitive data from memory when the vault is locked and reloads its process after 10 seconds of inactivity to ensure "garbage collection" wipes the RAM.
2026 Research (ETH Zurich): A 2026 study found that even popular cloud-based managers (Bitwarden, LastPass, Dashlane) had edge-case vulnerabilities where researchers could extract or even modify vault data by impersonating server responses or exploiting complex code structures in the browser extensions.

3. Comparison: Browser vs. Third-Party Manager

Protection Layer	Browser (Chrome/Brave/Edge)	Third-Party Manager (e.g., Bitwarden)
Encryption Key	Tied to OS Login (Easy to bypass)	Independent Master Password (Hard)
Memory Cleanup	Weak; often stays in RAM while browser is open	Aggressive; wipes RAM on lock/timeout
Malware Defense	Targeted by 99% of "infostealers"	Targeted by sophisticated "memory harvesters"
Auto-Lock	Usually No	Yes (Essential for memory security)

4. How to Defeat Memory Scrapers in 2026

To protect yourself against malware that "lives" in your RAM, the industry now recommends these three steps:

Strict Auto-Lock: Set your password manager to lock after 1 to 5 minutes of inactivity. When the vault is locked, the decryption keys are purged from RAM, leaving the malware with nothing to find.
Hardware Security (2FA): Use a YubiKey or Passkeys. Even if a hacker scrapes your password from memory, they cannot use it to log in from their own computer because they don't have your physical hardware key.
App-Bound Encryption: If you use Chrome, ensure "App-Bound Encryption" is active. If you use Firefox, always use a Primary Password. These features make it much harder for external processes to "ask" the browser for your keys.

The takeaway: A third-party manager is still your best defense, but its security is only as good as your Auto-Lock settings. If you leave your vault unlocked all day, you are leaving the door open for memory-scraping malware.

XxXxX · May 5, 2026

password managers are a trade off
security and convenience

some are better at one thing then the other
but its all down to what the end user wants

hence the push to passkeys and 2FA
and other forms such as biometric
best of luck Steve ..

echo2446 · May 6, 2026

Mark K said:
Firefox: When you use a Primary Password, Firefox acts more like a dedicated manager (e.g., Bitwarden). 1 It keeps the decryption key itself encrypted. 2 When you close the browser, that "session" key is wiped from memory. To see your passwords again, you must re-enter the Primary Password. 3

For Firefox, it's better to use a primary password because the passwords are stored on disk encrypted with that primary password, which your computer presumably doesn't have until you enter it.

Unfortunately, once you enter the primary password, the key to decrypt stays in memory until the browser is closed. Some passwords that have been decrypted will most likely remain in plaintext as well. In this sense, it's still better than Edge: passwords on disk can't be lifted in plaintext, passwords in memory stay encrypted while locked, and some passwords (that haven't been used) may remain encrypted while unlocked even if the key is in memory.

For third‑party password managers, have you noticed you can set them up to unlock the vault with a PIN or biometrics? That means while the vault is locked, the passwords are encrypted in memory, but the key still exists somewhere, protected by whatever mechanism you use (PIN or biometrics). If the vault is unlocked, the key to decrypt the vault is in memory, and for some password managers (including Bitwarden), all the passwords will be in plaintext in memory.

If you need to use a password manager, it's better to use a third‑party one because they put more work into keeping it secure in more situations; after all, they don't have to spend time making the browser itself work well.

Mark K · May 6, 2026

XxXxX said:
hence the push to passkeys and 2FA
and other forms such as biometric

I was surprised that Microsoft did not recommend passkeys. Instead Microsoft said working by design.

SgtStanko · May 6, 2026

I use the paid version of Bitwarden and use 2FA with it.

I make a point of to never install or use anything Google on my system and Edge is removed. If Microsoft treats edge the same way it treats it's Windows updates then Edge is nothing but a F@*ked up mess and a security nightmare. I've never even used it.

Mark K · May 6, 2026

SgtStanko said:
I use the paid version of Bitwarden and use 2FA with it.

My only problems with these third-party password managers is that your passwords are stored in the "cloud" somewhere. I know they have good security layered where the data is supposedly not accessible, but the chance is there like anything else.

SgtStanko said:
I make a point of to never install or use anything Google on my system and Edge is removed. If Microsoft treats edge the same way it treats it's Windows updates then Edge is nothing but a F@*ked up mess and a security nightmare. I've never even used it.

There are always security problems/concerns/issues in whatever browser you use. I switch among them mostly, but primarily use Google Chrome. I keep saying for years that I am going to stop using Google Chrome, but remain on it. I see Google the lesser of the evil right now.

When I run Linux, I use Mozilla Firefox all the time. I feel safer in Linux, but I do not run it all the time.

andrew129260 · May 6, 2026

Again, for me the main issue is regardless if you use edge or not, it has been known to import passwords and history without consent.

Meaning the passwords stored in other browsers are vulnerable to this "attack" even if you never use edge.

It accidently opens one time? Your screwed because of this.

gunrunnerjohn · May 6, 2026

andrew129260 said:
https://twitter.com/x/status/2051308329880719730

Researcher shows Edge saves passwords in memory in cleartext, 'even when you're not using them'

You do need admin rights to get that far, though.

www.pcgamer.com

What makes this more frustrating is that edge automatically pulls your passwords and history into it sometimes from other browsers automatically. Making all of them vulnerable as well..

Microsoft's response was this was by design....

WOW! One more reason not to let browsers store any passwords!

oldschool · May 6, 2026

Little black book. Less convenience. More secure. The old school way.

And there is this from Tavis Ormandy of Project Zero in his discussion of password managers.

If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions.

I use Chrome, but the other major browsers like Edge or Firefox are fine too. They can isolate their trusted UI from websites, they don’t break the sandbox security model, they have world-class security teams, and they couldn’t be easier to use.

No doubt there will be many people reading this who don’t like this advice. All I can say is I’ve heard all the arguments, and stand by my conclusions.

Password Managers.

pseymour · May 6, 2026

Overlooked with the Edge thing, at least in what I’ve read, is access to the memory. Sure, you normally need to be an admin to dump memory, and no one should relax that requirement. That doesn’t help, however, if there’s a memory leak, and browsers are notoriously leaky (all of them). So if passwords are in memory in cleartext… well that’s fun.

garlin · May 6, 2026

The same question can be extended to e-mail clients. Does your desktop mail app cache passwords in the clear?

I used to support an online service, which had POP servers. We were instructed that absolutely no one (except the admins) would have access to them, because clear text passwords were stored in memory. If there was a crash dump to debug, only one dev was trusted to examine its contents.

This issue isn't strictly limited to browsers, or browser extensions.

Slavic · May 6, 2026

Windows Central also published an article about this issue:

Microsoft Edge loads your passwords into memory in plaintext, but Microsoft says not to worry

A security researcher has discovered that Microsoft Edge will load all your stored passwords into memory in plaintext at startup, making it easy for malware to scrape those passwords.

www.windowscentral.com

As I understood, the Microsoft's argument is: if you have a memory spy on your PC, which is able to read the decrypted passwords in the browser memory, then your system is already infected. If you are not infected, no reason to worry.

I don't think this is a good point. At least, two lines of defence (antivirus and encryption in memory) is much better than only a single line.

pseymour · May 6, 2026

Slavic said:
I don't think this is a good point. At least, two lines of defence (antivirus and encryption in memory) is much better than only a single line.

I have a military friend that explains it thusly… tanks don’t rely only on camouflage for defense, but that doesn’t mean we paint the things bright orange either.

neldog · May 6, 2026

pseymour said:
I have a military friend that explains it thusly… tanks don’t rely only on camouflage for defense, but that doesn’t mean we paint the things bright orange either.

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

1. The Key Difference: Application-Level vs. OS-Level​

2. Handling Passwords in Memory (RAM)​

My Computers My Computers

At a glance

Well-known member

My Computers My Computers

At a glance

Peaceful Citizen

My Computers My Computers

At a glance

At a glance

Well-known member

1. How They Protect You (and Where They Fail)​

2. Specific Vulnerabilities in 2026​

3. Comparison: Browser vs. Third-Party Manager​

4. How to Defeat Memory Scrapers in 2026​

My Computers My Computers

At a glance

Just a Computer User

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Rancho Seldom Siesta

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computers

My Computers

1. The Key Difference: Application-Level vs. OS-Level

2. Handling Passwords in Memory (RAM)

My Computers

My Computers

My Computers

1. How They Protect You (and Where They Fail)

2. Specific Vulnerabilities in 2026

3. Comparison: Browser vs. Third-Party Manager

4. How to Defeat Memory Scrapers in 2026

My Computers

My Computers

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computers