5

UPDATE: The question assumes there's no master password set in FF that protects the password DB.

As far as I'm aware, Firefox profiles store your website passwords in cleartext (or at least, not in hashed/salted form).

As such, I'm looking for a program that would let me extract the list of passwords from Firefox.

Requirements:

  • Free or extremely cheap (under $1)
  • Extracts from any version of Firefox on Windows that is less than 2 years old.
  • Won't be broken just because FF bumped the version by 1 (assuming the new version doesn't change the password storage mechanism)
  • Extra credit: ability to insert the extracted password file into a FF profile, replacing or augmenting current set of passwords.
  • OK if the program is in the form of some Perl/Python published script; or standalone, or Mozilla plug-in - assuming the rule about FF version compatibility 2 years back stands.
  • OS Compatibility: MUST work on Windows. But extra points if it works on other OSs, especially Android FF and Linux.
| improve this question | |
  • Extract format is irrelevant as long as it's cleartext and parseable by a script. XML, CSV, whatever – DVK Mar 9 '14 at 2:47
6

Firefox profiles store website passwords in an easily decryptable format (Base 64, so it's more about encoding than encrypting) only if no master password was set (if a master password is set then 3DES is used by default).

FireMasterCracker can recover the master password successfully from any Firefox browser, starting with version 1.0 or more. (dictionary-based attack, so it depends on the master password's strength)

enter image description here

If there is no master password, or you know the master password, you can use FirePasswordViewer

  • Free but not portable. Beware to decline the adware during installation.
  • Extracts from any version of Firefox on Windows that is less than 2 years old.
  • Won't be broken just because FF bumped the version by 1 (assuming the new version doesn't change the password storage mechanism)

enter image description here

| improve this answer | |
  • Sorry, I wasn't clear. The question assumes no master password was set. – DVK Mar 9 '14 at 17:34
  • OK I added a tool when there is no master password, or you know the master password. – Franck Dernoncourt Mar 9 '14 at 17:39
  • 1
    And that, kids, is why you should never, ever use FF's native password manager. Yikes. – user456584 Mar 9 '14 at 20:31
  • @user456584 how about other browser? – Fractaliste Mar 11 '14 at 17:10
1

Try NirSoft's PasswordFox. I haven't use it specifically, but I've used a number of NirSoft's tools and found them to be, generally, of quite high quality.

PasswordFox
(source: nirsoft.net)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.