Many people ask me about the location in the Registry or file system that Windows applications store the passwords. So I prepared a list of password storage locations for more than 20 popular applications and Windows components.
Be aware that even if you know the location of the saved password, it doesn't mean that you can move it from one computer to another. many applications store the passwords in a way that prevent you from moving them to another computer or user profile.
However, you can use this information to remove unwanted saved passwords from your system.
- Windows Network Passwords (XP/Vista/2003): When you connect to the file system of another computer on your network (something like \\MyComp\MyFolder), Windows allows you to save the password. If you choose to save the password, the encrypted password is stored in a credential file.
The credential file is stored in the following locations:- Windows XP/2003: [Windows Profile]\Application Data\Microsoft\Credentials\[User SID]\Credentials and [Windows Profile]\Local Settings\Application Data\Microsoft\Credentials\[User SID]\Credentials
- Windows Vista: [Windows Profile]\AppData\Roaming\Microsoft\Credentials\[Random ID] and [Windows Profile]\AppData\Local\Microsoft\Credentials\[Random ID]
You can use my Network Password Recovery utility to view all passwords stored in these Credentials files.
- Dialup/VPN Passwords (2000/XP/Vista/2003): Dialup/VPN passwords are stored as LSA secrets under HKEY_LOCAL_MACHINE\Security\Policy\Secrets. This key contains multiple sub-keys, and the sub-keys which store the dialup passwords contains one of the following strings: RasDefaultCredentials and RasDialParams.
This key is not accessible from RegEdit and other tools by default, but you can use one of the following methods to access this key:
- Use at command to run RegEdit.exe as SYSTEM user: (doesn't work under Vista)
For Example:
at 16:14 /interactive regedit.exe - Change the permission of entire Security key. If you do that, it's recommeneded to return the permissions back to the original after you finish.
- Use at command to run RegEdit.exe as SYSTEM user: (doesn't work under Vista)
- Internet Explorer 4.00 - 6.00: The passwords are stored in a secret location in the Registry known as the "Protected Storage". The base key of the Protected Storage is located under the following key: "HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider". In order to view the subkeys of this key in RegEdit, you must do the same process as explained for the LSA secrets.
Even when you browse the above key in the Registry Editor (RegEdit), you won't be able to watch the passwords, because they are encrypted. Also, this key cannot easily moved from one computer to another, like you do with regular Registry keys.IE PassView and Protected Storage PassView utilities allow you to recover these passwords.
- Internet Explorer 7.00 - 8.00: The new versions of Internet Explorer stores the passwords in 2 different locations. AutoComplete passwords are stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2. HTTP Authentication passwords are stored in the Credentials file under Documents and Settings\Application Data\Microsoft\Credentials , together with login passwords of LAN computers and other passwords.
IE PassView can be used to recover these passwords.
More on: http://www.nirsoft.net/articles/saved_password_location.html
