Your browser passwords are locked under your Windows account — that lock is real, but it is not always the end. Here are the honest ways back in, in the order to try them, and the limit nobody can honestly cross.
Here is the truth first, because everything else hangs on it. The passwords saved in Chrome or Edge are not stored as plain text. They are encrypted, and the key that unlocks them is itself locked by your Windows user account — a Windows protection system called DPAPI. So if the Windows password for that profile is truly gone, most saved passwords cannot be decrypted — not by a trick, not by a clever tool, not by paying someone. Any video or tool that promises otherwise without naming its condition is overselling. But read on before you give up: "the password is gone" is often not the whole story. In practice there are honest doors — a session that is still logged in, a synced Google or Microsoft account, a password reset done the safe way. This guide walks through those doors in the order you should try them, and tells you honestly where each one ends.
👆 The lock is a chain — every route in this guide works by opening one link of it honestly, never by breaking the encryption itself.
"I forgot my Windows password" covers four very different situations, and each one has a different honest answer:
If any session is still alive — the PC still signs you in, or Chrome on this PC or another device still opens — export now, before a restart or a cleanup closes the door. A living session has already passed the Windows gate, so the browser can read its own passwords.
chrome://settings/passwords (Edge: edge://settings/passwords)Also check your phone: if Chrome or Edge on the phone is signed into the same account, its Password Manager is another living copy.
If Chrome Sync was on, your passwords are in your Google account, not only on this PC. Open passwords.google.com on any device and sign in — the passwords are listed there, and the lock you now need to open is your Google account, which has its own recovery (recovery email, phone number, backup codes). Edge works the same way through your Microsoft account.
Honest limits: if sync was off, or the passwords toggle inside sync was off, there is nothing in the account to recover. And if the account password is also forgotten, account recovery — not any PC tool — is the real job. That job is worth doing properly, because the account usually holds your email too.
Sometimes the right target is not the browser at all — it is the Windows sign-in. But how you reset matters enormously:
Many people pull the old hard drive, plug it into a new PC, copy the Chrome folder across — and find the passwords will not open. That is expected, not a mistake: the DPAPI keys do not travel with the folder. If you still know the old Windows password, expert-level offline recovery using that password exists as a documented technique and is genuinely technical. If the old PC can boot at all, even slowly, booting it and using Route 1 is simpler and safer. The full honest picture has its own page in this set.
Let us state it without decoration: nobody can decrypt your Login Data file without one of the honest doors — a live logged-in session, the profile's Windows credential, or the synced cloud account. Tools that view saved passwords (the NirSoft viewers are the well-known class) work inside your own logged-in session — they ask Windows to decrypt, and Windows agrees because you are signed in. Run the same tool on a locked profile from outside and it shows nothing useful. Any service that asks you to upload your Login Data file and promises to "crack" it is either misinformed, lying, or collecting password files — handing that file to strangers is a security disaster by itself.
If every door is closed, the practical recovery is unglamorous but real: the Login Data file still lists which sites you had accounts on, and your email inbox holds the rest — reset the password at each important site, one by one, and land them in a password manager as you go. That is how most of these stories actually end, and it does end.
Watch the video for the on-screen walkthrough of these recovery routes — and keep this page's honesty notes beside you while you try them.
▶️ Watch Full VideoOnly when an honest door exists — a session that is still logged in, the Windows credential itself, or the synced Google or Microsoft account. The encryption (DPAPI) is real: without one of those doors, the Login Data file cannot be decrypted, and any tool or service promising to do it anyway is overselling or worse.
Because the reset replaced your sign-in, but the DPAPI master key that protects the browser passwords was encrypted with your old password. Windows cannot re-open it with the new one. This is exactly why a forced local reset should be the last resort, after trying a still-logged-in session and the synced account first.
No. It still shows the list of websites you had saved accounts for, which is the perfect checklist for resetting passwords site by site through your email. Combined with your synced account (if sync was on), most people rebuild their whole list this way — slower than a magic tool, but real.