Recovering saved passwords from a 2018 version of Firefox requires locating the specific profile folder on your computer and copying two critical files:
logins.json and
key4.db. These files contain the encrypted credentials and the encryption key necessary to decrypt them. You cannot simply view these files in plain text; you must transfer both files together to restore access, as the key is tied to your operating system user account.
Locating Your Firefox Profile Directory
The first step is finding where Firefox stores your personal data. This location varies slightly depending on your operating system, but the structure remains consistent. Open Firefox and type
about:support into the address bar, then press Enter. On this page, look for the "Profile Folder" section. Click the button labeled "Open Folder" (Windows/Linux) or "Show in Finder" (macOS). This action opens the actual directory containing all your bookmarks, history, extensions, and password databases.
Do not close Firefox while doing this, as it may lock some files. If Firefox is closed, navigate manually to the following paths:
- Windows:
%APPDATA%\Mozilla\Firefox\Profiles\
- Mac:
~/Library/Application Support/Firefox/Profiles/
- Linux:
~/.mozilla/firefox/
Inside this main profiles directory, you will see one or more folders with names ending in
.default or similar random strings. Identify the correct profile by checking the modification dates or looking for the
places.sqlite file. Once inside the correct profile folder, you are ready to extract the password data.
Extracting the Critical Files
You need to copy two specific files from the profile directory to a safe location, such as a USB drive or a secure cloud storage folder. These files work in tandem. The
logins.json file holds the usernames and encrypted passwords. The
key4.db file contains the master key used to decrypt that data. Without both, the passwords remain unreadable garbage.
Right-click
logins.json and select Copy. Then right-click
key4.db and select Copy. Paste them into your chosen backup location immediately. It is crucial that you do not modify these files in any way. Even a single character change in
key4.db will render the passwords unrecoverable. If you have set up a Firefox Account sync, these files might be redundant because your passwords are stored in Mozilla's cloud, but for local-only recovery, these two files are the only source.
Restoring Passwords to a New Installation
If you are trying to recover passwords after reinstalling Firefox or switching computers, you must place these files back into the new profile directory. First, install Firefox and create a new profile if necessary. Navigate to the new profile folder using the same method described earlier (
about:support). Stop Firefox completely before pasting the files.
Paste
logins.json and
key4.db into the new profile folder. If prompted to replace existing files, confirm the replacement. Restart Firefox. Go to
about:logins to verify that your passwords have appeared. Note that this process does not work across different operating systems if a Master Password was enabled, because the encryption key is bound to the OS user session. For example, a key generated on Windows cannot decrypt data on Linux without the original Master Password input.
For users concerned about browser performance while managing accounts, understanding how to handle heavy pages can be useful alongside security tasks. See
How to Load All Images on a Facebook Page at Once for tips on optimizing resource usage during intensive browsing sessions.
Understanding Encryption and Security Risks
It is important to understand why Firefox uses this dual-file system. The
key4.db file is encrypted using your operating system's credential manager. On Windows, this often ties into the Windows DPAPI (Data Protection API). On macOS, it uses the Keychain. This design ensures that even if someone steals your hard drive, they cannot easily read your passwords without also having access to your logged-in user account.
However, this binding creates a significant limitation. If you lose access to your original computer or user account, the
key4.db file becomes useless unless you remember the Firefox Master Password you set years ago. There is no backdoor to retrieve this key. Therefore, keeping a backup of both files is essential for long-term recovery. Do not rely solely on cloud sync if you want offline access, as sync keys are also protected.
If you encounter issues with network connectivity while attempting to sync these passwords or troubleshoot related errors, ensure your connection is stable. For help with persistent connection issues, refer to Firefox: Retry failed downloads automatically, which covers similar background process behaviors.
Frequently Asked Questions
Can I recover passwords if I forgot my Firefox Master Password?
No, you cannot recover the passwords if you forgot the Master Password and do not have the
key4.db file from an active session. The Master Password encrypts the key within
key4.db. Without it, the data is mathematically irretrievable.
Will copying these files work on a different computer?
Only if you did not use a Master Password. If no Master Password was set, the
key4.db is tied to your OS user account. Moving it to a different computer usually fails because the new OS cannot decrypt the key. It works best when restoring to the same machine or a fresh install on the same device.
What if I only have logins.json but not key4.db?
You cannot recover the passwords.
logins.json contains only encrypted blobs. The decryption key resides exclusively in
key4.db. Without the key, the login data is permanently locked.
Does Firefox Sync store passwords differently than local files?
Yes. When synced, passwords are encrypted with a key derived from your Firefox Account password. Local files use OS-level encryption. Restoring local files bypasses sync entirely. You should not mix synced and local password stores as it can cause conflicts.
Is it safe to share these files with tech support?
No, never share
key4.db with anyone. Since it allows decryption of your passwords, giving it to someone effectively gives them full access to every site you have saved. Only transfer these files to your own trusted devices.