Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

andrew129260 · May 15, 2026

TairikuOkami said:
Using a browser to save passwords has been a big no no for several decades, extensions are not better either.
I use Bitwarden desktop app, it is a bit cumbersome to copy/paste, but it is much more safer in a long term.

The problem is the public here, not the people who know better or dont care.

All the more reason why passkeys need to be implemented asap everywhere.

TraderGary · May 15, 2026

I use 1Password with end-to-end encryption. Passwords are encrypted at all times, even locally.

garlin · May 15, 2026

What's lost in this discussion is whether your password manager (native to the browser or an extension), caches passwords in memory or eventually throws them out after a preset time period.

For absolute security, a password manager needs to keep a decrypted password in memory only for the shortest amount of time. Long enough to copy into a web form and be submitted. Any longer, a process risks the possibility of being snooped or someone invoking a process exception, which causes Windows to create a crash dump.

A crash dump is simply a copy of the failed process's entire memory footprint at the time of the error. It may contain decrypted passwords stored in memory. So a secure program needs to throw away (or zero out) the decrypted passwords as soon as possible.

It could be you use a very strong encryption method for protection, or you own a lot of passwords. The time to unlock the database may be noticeable and annoying to the user. Many password managers can end up caching the unlocked passwords in memory for a long time (relative to the fact you stopped needing to fill in a form several minutes ago).

I use 1Password myself, and it times out after a while. You're forced to enter your 1Password password to unlock the database again. Presumably what 1Password is doing is throwing away the in-memory results and starting over. This means it's slow, but more secure. Other password managers might be keeping the unlocked password in memory until the browser exits.

That's the real question to ask your software maker. Do they properly dispose of in-memory passwords after an idle period?

TraderGary · May 15, 2026

garlin said:
What's lost in this discussion is whether your password manager (native to the browser or an extension), caches passwords in memory or eventually throws them out after a preset time period.

For absolute security, a password manager needs to keep a decrypted password in memory only for the shortest amount of time. Long enough to copy into a web form and be submitted. Any longer, a process risks the possibility of being snooped or someone invoking a process exception, which causes Windows to create a crash dump.

A crash dump is simply a copy of the failed process's entire memory footprint at the time of the error. It may contain decrypted passwords stored in memory. So a secure program needs to throw away (or zero out) the decrypted passwords as soon as possible.

It could be you use a very strong encryption method for protection, or you own a lot of passwords. The time to unlock the database may be noticeable and annoying to the user. Many password managers can end up caching the unlocked passwords in memory for a long time (relative to the fact you stopped needing to fill in a form several minutes ago).

I use 1Password myself, and it times out after a while. You're forced to enter your 1Password password to unlock the database again. Presumably what 1Password is doing is throwing away the in-memory results and starting over. This means it's slow, but more secure. Other password managers might be keeping the unlocked password in memory until the browser exits.

That's the real question to ask your software maker. Do they properly dispose of in-memory passwords after an idle period?

I also use 1Password. It's my understanding that 1Password only decrypts long enough to do password entry. I use fairly fast hardware as you can see by clicking on My Computers. My Internet connection is close to gigabit speed. I don't detect any slowness. I use the 1Password browser extension, do you? You don't fill out your forum computer specs.

BruceR · May 15, 2026

An Edge update has removed this practice:

Changes to password manager. Changes to ensure passwords no longer load into memory on startup.

Version 148.0.3967.70: May 15, 2026 (Stable)

garlin · May 15, 2026

TraderGary said:
I also use 1Password. It's my understanding that 1Password only decrypts long enough to do password entry. I use fairly fast hardware as you can see by clicking on My Computers. My Internet connection is close to gigabit speed. I don't detect any slowness. I use the 1Password browser extension, do you? You don't fill out your forum computer specs.

I'm old school, I don't use the browser extension but the legacy 1Password desktop client. So my browser can't see anything I don't copy & paste. But that's just me.

Mark K · May 15, 2026

Mark K said:
Microsoft wrote "We will no longer load passwords into memory on startup." What is changing in handling the password information in memory to web sites? I did not see any information on what is changing in handling the password/memory security concern.

In Microsoft Edge 148.0.3967.70, Microsoft only changed the part of not loading password in memory at startup in plain text.

See: Version 148.0.3967.70: May 15, 2026 (Stable)

BruceR · May 15, 2026

Mark K said:
In Microsoft Edge 148.0.3967.70, Microsoft only changed the part of not loading password in memory at startup in plain text.

See: Version 148.0.3967.70: May 15, 2026 (Stable)

So now it works the same as all other browsers?

Mark K · May 15, 2026

BruceR said:
So now it works the same as all other browsers?

That is what I am trying to find out. I thought Microsoft would provide that detail in the follow up.

KevTech · May 15, 2026

garlin said:
For absolute security, a password manager needs to keep a decrypted password in memory only for the shortest amount of time.

I have KeePass set for 12 seconds.

dacrone · May 15, 2026

If truly worried about it, host it yourself using PleasantPassword

Purchase - Pleasant Password Server

Because we are hassle-free, our prices are openly listed and are a one-time payment with no required annual license fees. If these pricing packages don’t suit your current needs, we would be happy to provide a custom quote.

pleasantpasswords.com

Microsoft Edge loads all your saved passwords into memory in cleartext — even when you’re not using them.

Well-known member

My Computers

Stock Market Wizard

My Computers

Well-known member

My Computer

Stock Market Wizard

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Similar threads