Password · guide

The Firefox password manager, and the setting you can lose it all to

By Alberto Gulotta · Updated 9 September 2026 · 16 min read

The Firefox password manager is built into the browser and keeps its list on your computer, not in your Mozilla account. Click the menu button, then Passwords. One setting there deserves reading first: the Primary Password cannot be recovered, only reset, and the reset takes every saved login with it.

Two different locks, and only one of them can cost you the contents. Figure drawn by AI Tools Primer.

Where Firefox keeps them, and who can open the list

Firefox’s own answer is short and it is worth having in front of you before anything else: it “stores your logins securely on your computer”, in your Firefox profile. Not in your Mozilla account, not on a server you have to trust for the copy to exist. The account’s job is Sync, which is a different job.

To see the list: click the menu button, then Passwords. The about:logins page opens in a tab, and from there you can search, copy, reveal, edit or remove any entry. The same list is available from the Firefox sidebar — the gear icon at the bottom of the sidebar, then Passwords in the tools menu, and a key icon appears.

On Windows and macOS, Firefox puts your computer’s own password in front of the reveal, copy and edit buttons. Mozilla is careful to head off the confusion this causes: “This is not your Mozilla account credentials.” It is the machine asking, not the browser, and it is why the list is not readable by someone who simply sits down at an unlocked profile and knows where to click.

There is also a section Mozilla wrote because people kept asking, and it settles a question this page would otherwise have to guess at: “Passwords saved in Firefox are available only inside Firefox on your computer (and inside Firefox on your other devices, if you use Sync). Passwords saved in your Google Account are available when you sign in to Chrome or use Google services.” Two drawers, no overlap, and switching browsers does not move the contents.

The Primary Password, and the price of forgetting it

This is the part to read before you turn it on. Firefox offers a Primary Password: one password that unlocks all the others. Mozilla describes it as protecting “all of your locally stored usernames and passwords with a global password”. It is off until you set it, and setting it is the single biggest thing you can do to the security of that drawer.

It is also the single biggest thing you can do to your ability to lose it. There is no recovery, only a reset, and Mozilla writes the consequence twice on the same short page, once at the top and once at the bottom: “Resetting your Primary Password will remove all of your saved usernames and passwords.” Not lock them, not hide them — remove them.

The reset itself is deliberately obscure, which tells you how final it is: you type chrome://pippki/content/resetpassword.xhtml into the address bar, press Enter, and click Reset on the page that appears. That is the whole procedure, and what is on the other side of it is an empty list.

So the honest advice is two sentences long. Turn it on if the machine is shared or travels, because it is real protection and nothing else in the browser does that job. And the moment you turn it on, put that one password somewhere that is not the machine, because the day you forget it Firefox will not help you and neither will anybody else.

The only door out of a forgotten Primary Password leads to an empty drawer. Figure drawn by AI Tools Primer.

The two passwords Firefox can ask for before it shows you a saved one, what each protects, and what happens when you forget it
What Firefox asks for	When	What it protects	If you forget it
Your computer password (device sign-in)	On Windows and macOS, before you view or copy a saved password	The act of reading the list on this machine	Nothing is lost here: it is the operating system’s password, reset the usual way
The Primary Password (off by default)	Every time the saved logins are unlocked, once you set one	“all of your locally stored usernames and passwords”	Every saved username and password is removed. Mozilla says so twice on the same page

Why this is the fact to lead with, rather than the menu path. A guide that stops at where the button is has answered the easy half. The saved-password list is the one drawer in a browser whose contents you cannot reconstruct from anywhere else: the whole point of it is that you no longer know what is inside. So the settings that can empty it matter more than the settings that fill it, and there is exactly one of those. That is the same test being applied across this group of guides — not which manager is best, but what each one does on its worst day, and whether the maker says so.

On the phone, and the name half the web still uses

The route is Sync. Mozilla’s line is “to get your passwords everywhere you use Firefox, turn on Sync”: sign in to a Mozilla account on the desktop and on the phone, tick Logins and Passwords in the sync settings, and the same list appears in Firefox for Android and Firefox for iOS. On Android it can go further than the browser: from Firefox for Android “version 93 and above” there is a system-wide autofill toggle, under the three-dot menu, then Settings, then Logins and Passwords.

And the name. If you have searched this before, you have probably been told that Firefox’s password manager is called Firefox Lockwise. It is not, and it has not been for nearly five years. Lockwise was a separate app for Android and iOS, and Mozilla ended it with a dated notice: “Mozilla ended support for the Firefox Lockwise app on Android and iOS, effective December 13, 2021. Its functionality has been integrated into the Firefox for Android and iOS mobile browsers.” You cannot install it any more — “you are no longer able to install or reinstall Firefox Lockwise from the App Store or Google Play Store” — and the last builds were iOS 1.8.1 and Android 4.0.3, of which Mozilla says: “The application may continue to work on your device, but it will no longer receive support or security updates.”

That matters beyond trivia, because it changes what you should go and look for. There is no separate app to install and no second thing to set up: what people call the Mozilla password manager is the browser itself, on every device, and the only moving part is whether Sync is on.

Getting out, and the warning Mozilla puts on the door

Firefox exports to a .csv file, and the path is: menu button, Passwords, the menu icon on the about:logins page, then Export Passwords…. A dialog box appears to remind you that the passwords are saved as readable text, and you click the Continue with export button to go on; if you have set a Primary Password you are asked for it here, and Mozilla adds that “operating system authentication may be required” instead; then you choose a name and a place and click Save, and the file is written. Import works the same way, from another browser or from a file.

Mozilla’s warning on that page is the least ambiguous sentence any of these makers writes about their own export, and it deserves quoting whole: “Your passwords in the exported file will not be encrypted and will be in a readable form to anyone who can view this file. Do not upload online, email or share the exported file. Delete this file when finished.”

NIST files exactly that object under a named heading. In the table of ways an authenticator is compromised, under Duplication — the ways a credential is copied without anything being broken — sit the two lines “Passwords written on paper are disclosed” and “Passwords stored in an electronic file are copied.” A password export is the second line, created deliberately, by you, for a good reason. The reason does not change what the file is.

The same page has the blunt instrument too: the three-dot menu on about:logins has Remove All Passwords, which does what it says without any of the ceremony the Primary Password reset has.

Why the standard is on your side about using one at all

Quoted from NIST SP 800-63B, read in full on 8 September 2026.

Sites are told to let you use a manager “Verifiers SHALL allow the use of password managers and autofill functionality”, and where autofill is unavailable they “SHOULD permit claimants to use the ‘paste’ function”. A login form that blocks paste is the thing out of step, not you.

And the reason is measured, not assumed “Password managers have been shown to increase the likelihood that subscribers will choose stronger passwords, particularly if the password managers include password generators”. Firefox has a generator, and it is on the same settings page as everything else here.

The same document is careful in the other direction It lists “a vulnerability in an insufficiently secure password manager” among the ways credentials get duplicated, and tells organisations to “carefully evaluate password managers” before recommending one. Use a manager, and know which one.

And the case where none of this is the real problem. If you are here because a login stopped working rather than because you cannot find the list, the browser is probably not where the answer is: the password Firefox saved is a copy of one that belongs to an account somewhere else, and it is that account that has changed its mind. Resetting a Gmail password and changing a Microsoft password are the two commonest versions of that, and what to do after a breach is the one to work through if a saved password turned up somewhere it should not have.

Which of these settings costs what, and what the Lockwise name refers to, is our reading of the Mozilla pages below on the dates shown, not a claim Mozilla makes in one place.

Where to start

Three ways in.

“I just want to see my saved passwords.”: The list and the two ways to it — where they live
“Should I set a Primary Password?”: Yes, with one condition — primary password
“I want them on my phone, or out of here.”: Sync, and the export — on the phone

The accounts behind the saved copies

A password Firefox saved is a copy of one that belongs somewhere else. When the copy stops working, the original is what changed.

Resetting a Gmail passwordNo limit on attempts, a seven-day wait on new recovery details, and no number to call.Open this guide → Changing a Microsoft passwordSix things share that name, and three of them are changed somewhere other than where you are looking.Open this guide → A ChatGPT passwordWhether there is one to reset at all, and why the email never arrives when there is not.Open this guide →

The same drawer, other lids

Every browser and every phone keeps a version of this list, and they answer the four questions differently. That difference is the useful part.

The Opera password managerTwo of the four questions answered, and two the maker’s own help does not touch.Open this guide → The Apple password managerTwo names, one drawer, and a ten-attempt limit written into firmware.Open this guide → The Edge password managerOne condition decides whether you have it at all, and it is which profile you signed in with.Open this guide → When Google Password Manager will not answerThree documented causes, and the address to check first — plus the one case where that check needs a key of its own.Open this guide → Is Bitwarden safeTwenty-five published audits with the auditors named, and the password nobody can reset.Open this guide → Saved passwords on an iPhoneWhere the phone keeps what it saved, and who else can open the list.Open this guide → After a data breachWhat a reused password turns into once a company loses a list of them.Open this guide →

Questions people also ask

Where can I find the Firefox password manager?

Click the menu button and select Passwords. The about:logins page opens in a tab, where you can search, view, copy, edit or remove any saved login. The same list is available from the sidebar: the gear icon at the bottom, then Passwords in the tools menu.

Does Firefox have its own password manager?

Yes, built in, and it stores the logins on your computer rather than in your Mozilla account. The account is only involved if you turn on Sync, which copies the same list into Firefox on your other devices.

What happens if I forget my Firefox Primary Password?

There is no recovery, only a reset, and Mozilla states the consequence twice on its own page: “Resetting your Primary Password will remove all of your saved usernames and passwords.” Set one only if you keep it somewhere other than that machine.

Is the Firefox password manager still called Firefox Lockwise?

No. Lockwise was a separate phone app, and Mozilla ended support for it “effective December 13, 2021”, folding its functionality into the Firefox browsers for Android and iOS. It can no longer be installed. The manager inside Firefox has no separate name.

How do I get my Firefox passwords on my phone?

Turn on Sync: a Mozilla account signed in on both, with Logins and Passwords ticked in the sync settings. On Android, Firefox from version 93 can also fill passwords in other apps, through the three-dot menu, Settings, then Logins and Passwords.

How do I export passwords out of Firefox?

Menu, Passwords, then the menu icon on about:logins, then Export Passwords. A dialog box asks you to click Continue with export first. Mozilla warns that the file “will not be encrypted and will be in a readable form to anyone who can view this file”, and says to delete it when finished.

Not covered here. It does not cover Thunderbird, which keeps its own store of passwords with its own settings, even though it comes from the same place.

It does not rank password managers against each other, which is a different question with a different kind of answer; the way in is the guides on passwords and the ways in.

And it does not recover a password Firefox never saved: if the entry is not in the list, the route is that site’s own reset. What holds instead is simple: every path, warning and quoted sentence comes from Mozilla’s own support pages with the date each one was last updated, the Lockwise dates come from Mozilla’s own end-of-support notice rather than from the fact that newer pages stop mentioning it, and the clauses about password managers are quoted from the NIST publication.

Sources

Mozilla Support — Password Manager: remember, delete and edit logins and passwords in Firefox: the about:logins page and the sidebar route, the save and update prompts, the line that Firefox stores logins on your computer, the device sign-in prompt on Windows and macOS, Remove All Passwords, the Primary Password among the extra protections, and the section comparing Firefox passwords with Google passwords. Last updated 9 June 2026 — support.mozilla.org, read 8 September 2026.
Mozilla Support — Reset your Primary Password if you’ve forgotten it: that the feature protects all locally stored logins with a global password, the reset address, and the warning, stated twice, that resetting removes all saved usernames and passwords. Last updated 24 July 2024 — support.mozilla.org, read 8 September 2026.
Mozilla Support — End of support for Firefox Lockwise: the date support ended, the integration into the Firefox mobile browsers, that the app can no longer be installed, the last version numbers, and the Android system-wide autofill route from version 93 — support.mozilla.org, read 8 September 2026.
Mozilla Support — Export login data from Firefox: the export path through about:logins, the Primary Password prompt during export, and the warning that the exported file is unencrypted and readable. Last updated 13 August 2025 — support.mozilla.org, read 8 September 2026.
NIST SP 800-63B, Digital Identity Guidelines: the requirement that verifiers allow password managers and autofill, the finding on password generators, and the Duplication row listing passwords stored in an electronic file among the ways a credential is copied — pages.nist.gov, read 8 September 2026.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 9 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.