The most suggested fix is also the most dangerous one. Here is what each kind of Windows password reset actually does to your saved browser passwords — before you let anyone do it.
Sooner or later someone suggests it: "just reset the Windows password." It sounds like one action, but it is really three different actions with three different prices — and the most popular one quietly burns the very passwords you are trying to save. This page grades each route honestly before you touch any of them: what it saves, what it breaks, and when it is genuinely the right call. Rule for the whole page: try the live session and the synced account first. A reset is a door with no way back.
👆 Grades describe the normal documented behaviour — individual PCs vary, which is why the free routes go first.
If you sign into Windows with a Microsoft account, the password can be reset through Microsoft's official online flow using your recovery email or phone. When you then sign into the PC with the new password, Windows' supported machinery re-wraps your DPAPI protection around the new credential — saved browser passwords normally keep working afterwards. This is the reset the system was designed for, and it is why tying your sign-in to a Microsoft account quietly buys you a recovery route a local account never has. Verdict: do this one without fear, after the two free checks (live session, synced copy) — mostly because those are even faster.
A change is not a reset. If you (or the account owner) can present the old password, Windows changes it from inside the account and re-encrypts the DPAPI master key with the new one in the same motion. Everything survives. This is also why remembering even an older password matters: if the password was changed at some point and you remember the previous one, tell the person helping you before anyone forces anything — credentials have a memory, and DPAPI was built to use it through supported changes.
The famous one: an administrator resets the account, or someone boots from a USB stick and blanks the password. Windows will indeed let you in — the front door opens. But the DPAPI master key inside the profile was never re-wrapped; it still sits there encrypted with the old password, which nobody presented. Consequences, stated without varnish:
There are narrow exceptions — domain-joined machines have a DPAPI backup mechanism held by the domain, and luck exists — but treat them as windfalls, not plans. If a technician proposes the forced reset in the first five minutes, they are spending your passwords to save their time. Slow them down: live session, synced copy, Microsoft-account reset — in that order — and only accept the forced reset when those are truly exhausted and getting into Windows matters more than what is sealed inside it.
Watch the video for the complete recovery walkthrough — and grade your reset route on this page before using it.
▶️ Watch Full VideoYes, in order: check the synced copy at passwords.google.com or in the Microsoft account — it is unaffected by anything that happened on the PC. Check any phone or second PC still signed in. And if the old Windows password ever comes back to you, tell a technician before doing anything else; remembered credentials reopen options that guessing cannot.
In the normal case, yes — the supported flow re-wraps the DPAPI protection when you sign in with the new password. It is graded 'usually safe' rather than guaranteed because PCs vary (corrupted profiles, half-finished updates), which is why checking the synced copy first costs nothing and protects everything.
Because access and secrecy are different promises. An owner or administrator may urgently need to get into a machine whose user has left or forgotten everything, and Windows prioritises the machine being usable. The destruction is not a bug — it is DPAPI refusing to hand secrets to a credential it never vouched for.