Find a Saved Outlook Password in Windows Credential Manager
Before any tool is downloaded, check the vault Windows already has. On PCs where Outlook saved the mailbox password, Credential Manager will show it to the signed-in user after one identity check. Here is the route, and an honest picture of what the entries look like.
By Technical AnshuWindows 10 / 11 - Outlook7 minute read
Watch the full video - the authorised Outlook password recovery process, shown step by step
This route works in one specific situation: an older or basic-auth Outlook setup that saved the account password, on the PC of the user who saved it, while you are signed in as that user — your own PC, or a company PC you administer with the user's documented request. Windows seals each user's credentials with DPAPI keys tied to that user's sign-in, so the vault is only readable from inside that session. There is no admin back-door that reads another user's saved Outlook password, and any guide implying one is not telling the truth.
Credential Manager - an expanded mail entry (example)
PasswordShown as dots until you click Show and prove identity
PersistenceLocal machine or Enterprise - how long Windows keeps it
Caption: an example of a viewable stored credential. Many PCs show identity-only entries instead — see the notes below before concluding anything.
1
Open the Vault the Direct Way
Credential Manager is part of Control Panel and has not moved in years:
Sign in to Windows as the user whose Outlook you are servicing.
Press Windows + R, type control /name Microsoft.CredentialManager, press Enter.
Choose Windows Credentials (not Web Credentials — that side is mostly browser and app web logins).
Prefer a quick inventory first? A terminal listing shows every stored target name without revealing secrets: cmdkey /list — useful to confirm a mail entry exists before opening the vault.
2
What Outlook Entries Honestly Look Like
Set expectations before you scroll. On a typical office PC you will meet three kinds of entries:
Viewable mail credentials — older Outlook versions and POP/IMAP or basic-auth Exchange setups stored the actual mailbox password here, under the server or account name. These expand and offer a Show link.
SSPI identity entries — names like MicrosoftOffice16_Data:SSPI: followed by the address. These record who signed in. They carry no password to view, and no tool changes that.
Nothing at all — the normal result on Microsoft 365 PCs using modern authentication. The password never touched this machine.
Only the first kind can help you. Recognising the other two quickly is what separates a ten-minute job from a two-hour wild goose chase.
3
The Show Prompt Is the Security Working
Clicking Show asks for the current Windows password of the signed-in user. That is the entire protection model in one dialog:
The person whose credentials these are proves it is really them at the keyboard.
Only then does Windows decrypt and display the secret — on screen, in plain text, for as long as the dialog stays open.
If the user does not know their Windows password either, this route is closed. Resetting the Windows password from outside breaks the DPAPI keys and the stored credentials become unreadable — a hard Windows fact worth knowing before anyone suggests it.
Read the password, use it or relay it to the authorised user in person, and close the dialog. Never photograph the screen or paste the password into chat, email or the ticket — the ticket records the work, never the secret.
4
No Viewable Entry — The Honest Next Step
If the vault holds no usable password, the correct move is not a stronger tool: the secret is not on this PC in readable form, and legitimate utilities read the same vault and hit the same wall. Reset instead:
Microsoft 365 company account — admin center reset, user picks a new password with MFA confirming identity.
On-premise Exchange or domain account — directory reset by an admin.
Personal Outlook.com account — Microsoft's account recovery flow, owned by the user.
Hosted or ISP mailbox — provider control panel reset, then update every device.
After the reset, sign Outlook in with the new password and let this be the last time the password exists only in one person's memory — the prevention page in this set covers the password-manager fix.
🟡 Handle the recovered password like a key, not a note: eyes only, typed where needed, never stored in tickets, chats or screenshots. If it passed through more hands than the owner's, change it afterwards — a password several people have seen is already half-retired.
Watch the Complete Process in the Video
Watch the video for the authorised walk-through — opening Credential Manager on a real profile, recognising the entries, and what the technician does when there is nothing viewable saved.
Press Windows + R and run control /name Microsoft.CredentialManager, or open Control Panel, then User Accounts, then Credential Manager. Choose Windows Credentials for Outlook and mail entries; Web Credentials mainly covers browser and app web sign-ins.
Why does Show ask for my Windows password
Because the vault is encrypted with keys derived from your Windows sign-in. Typing the Windows password proves the account owner is at the keyboard and lets Windows decrypt the entry. Without that proof, Windows shows nothing — by design.
Can an administrator open another user's Credential Manager
An admin can open their own vault, not read another user's saved passwords. DPAPI keys belong to each user's sign-in. The supported pattern is the user signing in themselves — or an authorised password reset through the account system instead.
This guide is based on the Technical Anshu video linked above - Stuck on a step? Ask in the video comments - you will get an answer