Is it safe to save passwords in your browser?

Yes, your browser encrypts them

That has to come first, because it is where most of the writing on this subject goes wrong.

It is easy to find articles, some in large outlets, claiming that Chrome stores passwords "unencrypted" or "visible to anyone". That is not true. On Windows it encrypts them with a key tied to your operating system user account. And since July 2024, with Chrome 127, Google added app-bound encryption, which ties that key to the browser itself so another program cannot simply ask for it.

So "are they encrypted?" has a dull answer: yes. The problem is that this is not the right question.

What does that encryption actually protect against?

Here is the distinction that changes everything, and almost nobody spells it out:

• It protects against another person. Someone who walks off with your powered-down laptop, or boots from a USB stick and copies the files, finds unreadable data.
• It protects against another account on the same machine. If your partner or your brother has their own Windows user, they cannot read yours.
• It does not protect against a program running as you. And that is the point: the encryption is bound to your session, so anything running inside your session holds the key by definition.

Put differently: it is not a safe, it is a locked drawer whose key you carry the entire time you are using the computer. Against a burglar breaking in, useful. Against someone already inside wearing your face, not.

Why this changed in 2026

For a while it looked as though app-bound encryption had closed the door. It did not close it: it raised the price.

In March 2026 came VoidStealer, a credential stealer sold as a service that defeats that protection without needing administrator rights. Its technique is as elegant as it is uncomfortable to read:

• 1. It lets Chrome do the work. It does not try to break the encryption. It starts a hidden instance of the browser and waits.
• 2. It attaches to the process as a debugger. Exactly as a development tool would.
• 3. It waits for the precise moment Chrome decrypts its own key in order to use it, because at some point it has to.
• 4. It grabs the key from memory while it sits there in the clear, and from there reads passwords and session cookies.

The underlying lesson is not "Chrome is insecure". It is that data your computer must be able to decrypt in order to use it can also be decrypted by another program on that same computer. No future version fixes that.

And it is worth saying what this case does not say: it does not mean your passwords will be stolen because you use Chrome, nor that Firefox and Edge are safe by virtue of not being named. It means the bar for stealing them is lower than it was, and that malware is already being sold with the capability built in.

The question that does decide the risk

It is not "does the browser encrypt?". It is this:

How likely is it that something runs on my computer, as me?

And you can answer that yourself, because it turns on concrete things:

• Do you install software from odd places? Cracks, activators, "free" versions of paid software. This is route number one by a distance.
• Does your Windows session have a password? If not, all that browser encryption rests on an open door.
• Do you share the computer under one user account? A shared Windows profile removes the separation between people entirely.
• Do you install extensions without looking? An extension with broad permissions is already inside the browser.
• Is it a work machine, or someone else's? There you control neither what is installed nor who administers it.

If your answers are all reassuring, saving passwords in the browser is a perfectly reasonable risk. If two or three are not, you have a problem that changing browser does not solve.

The uncomfortable part: a manager has the same problem

This is where most articles cheat. They describe the browser's risk, recommend a password manager and leave, implying the problem goes away. It does not go away.

If malware is running as you and your manager is open at that moment, it can be read just the same. The malware breaks nobody's cryptography: it waits for you to open it.

The real difference is one thing, and it matters: the manager closes.

• The browser's store is available whenever your session is signed in. Which is, for most people, every hour the machine is switched on.
• The manager is locked by default and re-locks itself after a few minutes. Outside that window, what gets stolen is data encrypted with a key that is not on the machine.
• They are different things to steal. From the browser they take a file. From a locked manager, noise.

That is not a marketing distinction: it is the difference between a closed door and one left ajar. If you want the detail on which to pick, it is in the password manager comparison.

When the browser is perfectly fine

• Accounts that would not hurt. The newspaper, the forum, the shop you bought from once.
• Your own machine, with your own password-protected session, and no habit of installing things from anywhere.
• Measured against the real alternative. This matters far more than it sounds: if the choice is not "manager" but reusing the same password everywhere because you cannot remember them, the browser is clearly better than that.

That last point is what gets lost in the articles that give a flat no. A reused password is a certain, present risk; credential theft is a probable but not guaranteed one. Trading the second for the first is a bad deal.

When not to, no argument

• Your main email. It is the master key: every other account is recovered through it. It should not be saved anywhere.
• Banking and anything holding money.
• A work computer, or any machine someone else administers.
• A shared machine running on a single Windows user.
• Accounts holding other people's data: clients, patients, children.

What to do today, in ten minutes

In order of risk reduced per minute spent:

• 1. Turn on two-factor authentication for your email and your bank. It is the only item here that still protects you after the password is stolen, because the password alone stops being enough. If you do one thing today, this is it.
• 2. Take email and banking out of the browser. You do not need to migrate everything: delete those two and learn them or keep them elsewhere.
• 3. Put a password on your Windows session if it has none. It is the floor everything else stands on.
• 4. Review your extensions and remove the ones you do not use. Each is a program with access to what you do in the browser.
• 5. Check whether any have already leaked, because the browser does not protect you from a breach at the other end. How to check is in this guide.

If you think they are already in

The priorities change, and do it from another device, not the suspect computer:

• Main email first, always. Everything else hangs off it.
• Sign out of every open session on each account. Almost nobody does this and it is critical: whoever steals session cookies gets in without ever needing your new password.
• Then banking and anything holding money or other people's data.
• And only then the rest, calmly.

Changing the password without ending the open sessions is the most common mistake, and it leaves the door exactly as open as it was.

What to take away

That the question was badly framed. The browser encrypts; the encryption is not the weak point. The weak point is that your signed-in session is the key, and what modern malware does is wait for you to use it.

So it is not "browser yes or browser no". It is which accounts you can afford to lose. The ones that would not hurt, leave where they are. Email and banking, out, with a second factor. And if someone ever does get in, you know where to start and why ending sessions comes before almost everything else.