Managing your passwords for all your accounts can be a hassle, especially if you tend to forget them. Luckily, Windows stores most of your local accounts, so you can quickly and easily look them up. Find out where to locate your passwords on different Windows versions, and what other options Microsoft offers for password storage.
Contents:
Key takeaways
Windows 10 and 11 store passwords in Credential Manager, which you can access via Control Panel or by using Command Prompt. To access it, you need your administrator password or PIN first.
Windows 7 users can view saved passwords via Control Panel by navigating to “User accounts” and selecting "Manage your network passwords."
Local account passwords are located in the Security Accounts Manager (SAM) database on your C: drive, in a file that can’t be opened while the system is running. Windows always stores passwords as hashed values.
Built-in Windows password storage is generally secure but can be put at risk if someone finds out your administrator password and gains access to the device.
Where are passwords stored in Windows 10 and 11?
You have a few ways to find passwords stored on your computer in Windows 10 and Windows 11, and they work the same on both operating systems. Windows uses the Data Protection API (DPAPI) — a built-in encryption system that lets applications encrypt sensitive data, including passwords, using credentials tied to your user account and your device. The encryption key is derived from your Windows login credentials, and the data can only be encrypted by you using your computer. You must log in as an administrator to access passwords encrypted within your Windows storage.
To find where passwords are located on your computer, you need access to your administrator password or device PIN first. An administrator password is a login code that you use to gain administrator-level access to your Windows device. You can use it to make significant changes to your computer, like installing or uninstalling software, adjusting the system, or accessing and changing your passwords. Keep your administrator password secure and out of reach of unauthorized users — misuse of admin privileges can seriously damage your Windows system.
In some instances, the administrator password may be the same as the one you use to log in to your Microsoft account. However, if you’re not sure whether that’s the case, you can check your computer’s system first. To find your administrator password, you need to use Command Prompt to access the Windows registry and, in turn, your administrator password. Be careful as you adjust these settings because they control core system functions.
Registry editor
Type “Command Prompt” or “cmd” in the Windows search bar.
Right-click the application icon and select “Run as an administrator.”
Windows will prompt you to allow the app to make changes on your device. Click “Yes.”
In the Command Prompt window, type
regeditand hit “Enter.”The “Registry editor” window will appear.
In the left sidebar, select “HKEY_LOCAL_MACHINE” > “SOFTWARE” > “Microsoft” > “Windows NT” > “CurrentVersion” > “Winlogon.”
Locate “DefaultPassword” and double-click it.
A window will pop up, revealing the stored administrator password.
Note: If you use a PIN instead of a password to unlock your device, the “DefaultPassword” option won’t be available. Windows doesn’t let you view the PIN, but you can change or reset it. To do so, you need to:
Launch your computer.
In the login screen, select “I forgot my PIN.”
Select “Reset the PIN.”
Log in to your Microsoft account to receive a reset code.
The code will be sent to your email address. Copy it and paste it in the reset screen.
Set up the new PIN and click “OK.”
If you can’t see the “I forgot my PIN” option, you need to use your Microsoft account password to log in. Then you can reset the PIN in the Settings app:
Open the Settings app and select “Accounts” in the sidebar.
Select “Sign-in options.”
Select “PIN (Windows Hello).”
Click “Change PIN.”
Enter the new PIN and the current PIN for verification. Optionally, you can tick the box to include letters and symbols in your PIN for a stronger combination.
If you can't remember the current PIN, select “I forgot my PIN.”
Click “Reset the PIN.”
Verify your Microsoft account to receive the reset code.
Copy the code from the email you received and paste it in the reset screen.
Set up the new PIN and click “OK.”
As mentioned earlier, this method is risky because tampering with the Windows registry can damage your operating system. If you're nervous about meddling with the registry, you can follow our guide on how to find your logins using Windows 10 password recovery.
Once you have your administrator password, you can find your passwords via the credential manager or by using Command Prompt.
Credential manager
Open Control Panel.
Select “User accounts.”
Click “Credential manager.”
Here you can see two sections: “Web credentials” and “Windows credentials.”
Under “Web credentials,” you can find the passwords you use to log in to various websites. “Windows credentials” hosts the rest of the logins on your computer.
Find the account you need and click the arrow on its right side.
In the drop-down menu, click “Show” next to the password.
In the pop-up prompt, enter your administrator password or PIN.
Windows will now display the password.
Command Prompt
Type “Command Prompt” or “cmd” in the Windows search bar.
Right-click the application icon and select “Run as an administrator.”
Type the command
rundll32.exe keymgr.dll,KRShowKeyMgrand hit “Enter.”The “Stored user names and passwords” window will pop up.
Pro tip: Always double-check the commands you run for accuracy and ensure they include all the necessary commas, periods, and spaces.
Level up your online security
Store and manage your digital valuables safely
Where are passwords stored in Windows 7?
If you’re running Windows 7, you can manage your passwords via Control Panel:
Open the “Start“ menu and select “Control Panel.”
Go to “User accounts.”
Click “Manage your network passwords” on the left.
You will see your saved credentials.
What if the issue is not being able to log in to your computer in the first place? You can follow a few relatively easy ways to recover your Windows 7 credentials using our tutorial.
Where are local Windows account passwords stored?
Local Windows account passwords are stored in the Security Accounts Manager (SAM) database. You can locate the SAM in your device’s C: drive:
Open File Explorer.
Select “This PC” in the sidebar.
Under “Devices and drives,” select the C: drive. It may be named after your laptop’s model.
Open the “Windows” folder.
Open the “System32” folder.
Open the “config” folder.
Locate the file titled “SAM.”
The file contains hashes of your credentials and is also used by system recovery tools and backup software to preserve the system state. You can’t interact with the SAM file, but knowing its location helps you check whether your Windows system is operational and your password hashes are intact.
If your device is targeted by an attack that boots into a different operating system and disables the Windows kernel, cybercriminals can interact with the SAM file and extract the hashes. They can then also reset your administrator password and override your access to the computer.
You can check if the Security Accounts Manager on your device is running as expected in the Services navigation:
Press the
Windows key + Rto launch “Run.”Enter
services.mscin the “Open” field.The “Services” navigation will appear.
Scroll down and locate "Security Accounts Manager."
Double-click “Security Accounts Manager.”
Make sure that the startup type is set to “Automatic” and the service status shows “Running.”
What format does Windows use to save passwords?
All passwords stored in Windows are hashed and encrypted. For security reasons, Windows never stores credentials in a plaintext file. The hashes are maintained in the aforementioned SAM file and can’t be accessed by regular users even with administrative rights as long as the system is operational.
The hash Windows generates is unique to each password. However, if the user saves two items sharing the same passwords, the hash will be the same. For example, if you use “Password123” as the password to your email and banking accounts, they will share the same fixed 32-character hash.
Is the built-in Windows password storage safe?
Windows provides robust secure storage for credentials. All data is encrypted and can’t be decoded without the API or direct access to your computer. However, although the risk is low, if a criminal gains access to both your computer and administrator password or PIN, they can easily see what passwords you’re storing.
As an alternative storage option, you can use a designated app or browser extension to store your credentials. Microsoft’s default browser, Microsoft Edge, has built-in support for credential storage. Microsoft Password Manager lets users save passwords and passkeys, autofill them on login screens, and suggests passwords for new accounts — all standard features of a good password manager.
However, Microsoft Password Manager shares the same flaws as most other built-in browser managers compared to dedicated solutions. It works only with the Edge browser, making it inflexible if you need to change to a different provider. It also can only autofill credentials to websites, whereas password manager apps can also autofill data in other applications.
Microsoft Password Manager also lacks additional security features, like checking your vault for weak and vulnerable passwords. If your Microsoft account is compromised, cybercriminals can use those details to access passwords stored in your browser, making it a sizable security risk. You can switch off the Edge password manager in the browser’s settings.
Other ways to recover your passwords
If you’re worried about the safety of passwords stored in Microsoft-based systems or simply are preparing to migrate to a different browser or operating system, you can try alternative ways to store credentials. Unfortunately, you can’t export passwords stored in SAM, so the migration will take some manual work.
Most browsers nowadays, including Chrome, Firefox, and Safari, offer built-in password managers for easier access to credentials. They usually synchronize between the desktop and mobile apps, ensuring you can access your login details more flexibly. However, they’re still not as reliable as dedicated password manager apps and extensions. Browsers don't always provide clear information about the type of encryption their password managers use, and they can be easier to compromise than dedicated apps.
Instead of relying on your browser to protect your login details, you can try a password manager like NordPass. It’s available as an extension on all major browsers, a desktop app for Windows and macOS, and a mobile app for Android and iOS. This lets you easily sync your data across different devices.
NordPass supports storage for passwords, passkeys, secure notes, credit card details, and digitized documents. In addition to the XChaCha20-encrypted vault, NordPass offers additional features, like the Data Breach Scanner and Password Health, to help keep your personal information secure. Set up NordPass on your device and keep your passwords in one place that only you can access.