Firefox Password Internals

Firefox till version 3.5 stores the sign-on secrets in signons.txt file located in the Firefox profile directory. With version 3.5 onwards Firefox started storing the sign-on secrets in Sqlite database file named 'signons.sqlite'. The structure of sign-on information stored in the signons.txt file (signons2.txt for version 2 and signons3.txt for version 3) and signons.sqlite for version 3.5 onwards is described below...

For Firefox < version 2.0 First comes the sign-on file header which is always "#2c" Next comes the reject host list in clear text, one per line and terminated with full stop. After that normal host list is stored in the following format Host URL Name  (username or *password) Value (encrypted) .(full stop)    For Firefox version 2.0 First comes the sign-on file header which is always "#2d" Next comes the reject host list in clear text, one per line and ends with full stop. After that normal host list is stored in the following format Host URL Name  (username or *password) Value (encrypted) Subdomain URL .(full stop)    For Firefox version 3.0 and below 3.5 First comes the sign-on file header which is always "#2e" Next comes the excluded host list in clear text, one per line and ends with full stop. After that saved host list is stored in the following format Host URL Name  (username or *password) Value (encrypted) Subdomain URL --- (Dashed line denoting the end of host entry) .(full stop)    For Firefox version 3.5 and above The new signons.sqlite database file has two tables moz_disabledHosts and moz_logins. The moz_disabledHosts table contains list of excluded websites which are exempted from storing passwords by user. The moz_logins table contains all the saved website passwords. Here is more detailed description of each tables... table - moz_disabledHosts id - index of each entry hostname - blacklisted website URL table - moz_logins id - index of each entry hostname - base website URL httpRealm - formSubmitURL - Actual website hosting URL for which secrets are saved. usernameField - name of username element of form field passwordField - name of password element of form field encryptedUsername - encrypted username encryptedPassword - encrypted password guid - unique GUID for each entry encType - value 1 indicates encrypted

Here each Host entry can have multiple username/password pairs. Starting from Firefox version 2.0, sub domain URL is also included along with username/password entry. If it is the password field then it begins with '*'. This is the key in distinguishing between username and password entry. Now once the username and password values are extracted, next task is to decrypt them. Information required to decrypt these values is stored in key3.db file. If the master password is set, then you must provide the master password to proceed with decryption. If you have forgotten the master password, then you can use Firemaster tool to recover the master password. If the master password is set and if you have not provided it, then FirePasswordViewer will prompt you to enter the master password.