Structure of the Firefox places.sqlite Database

This article provides a comprehensive breakdown of the places.sqlite file found within a Mozilla Firefox user profile. It explores the internal SQLite database schema, detailing the specific tables and columns responsible for storing a user's browsing history, bookmarks, download metadata, and address bar behavior. By understanding the relational structure of these core tables, developers, system administrators, and forensic analysts can effectively query and interpret Firefox user data.

The Core Table: moz_places

The moz_places table is the central hub of the places.sqlite database. Every unique URL that Firefox encounters—whether through browsing, bookmarking, or downloading—is recorded here. Other tables reference this table using its primary key.

Key columns include:

  • id: The primary key that uniquely identifies the URL record.
  • url: The full web address (e.g., https://www.example.com/page).
  • title: The title of the web page as defined by its HTML <title> tag.
  • rev_host: The reversed hostname of the URL, used by Firefox for faster domain-based querying.
  • visit_count: The total number of times the user has visited this specific URL.
  • hidden: A boolean value (0 or 1) indicating if the URL should be hidden from the address bar autocomplete (often used for redirects or framed pages).
  • frecency: A score calculated by Firefox combining "frequency" and "recency" to determine how likely the user is to visit the URL again.
  • last_visit_date: The timestamp of the most recent visit, stored in PRTime format (microseconds since January 1, 1970, UTC).
  • guid: A globally unique identifier used primarily for syncing data across devices via Firefox Sync.
  • origin_id: A foreign key that links to the moz_origins table.

Browsing History: moz_historyvisits

While moz_places stores the unique URLs, the moz_historyvisits table logs every individual visit to those URLs. If a user visits the same webpage ten times, there will be one entry in moz_places and ten corresponding entries in moz_historyvisits.

Key columns include:

  • id: The unique primary key for the specific visit event.
  • from_visit: The id of the previous visit in moz_historyvisits that referred the user to the current page. If the user navigated directly, this is set to 0.
  • place_id: A foreign key referencing the id column in the moz_places table.
  • visit_date: The exact timestamp of the visit in PRTime format.
  • visit_type: An integer representing how the user arrived at the page. Common values include:
    • 1: Followed a link.
    • 2: Typed the URL in the address bar.
    • 3: Clicked a bookmark.
    • 4: Embedded content (e.g., an iframe).
    • 5: Permanent redirect (HTTP 301).
    • 6: Temporary redirect (HTTP 302).
    • 7: Downloaded a file.
    • 8: Framed link navigation.
    • 9: Reloaded the page.

Bookmarks Hierarchy: moz_bookmarks

The moz_bookmarks table manages the user's saved bookmarks, bookmark folders, and organizational separators. It uses a self-referencing hierarchical structure to maintain folder trees.

Key columns include:

  • id: The primary key for the bookmark item.
  • type: An integer defining the entry type (1 for a standard bookmark, 2 for a folder, 3 for a separator line).
  • fk: A foreign key pointing to moz_places.id. If the entry is a folder or separator, this value is NULL.
  • parent: The id of the parent folder within the moz_bookmarks table, establishing the folder hierarchy.
  • position: An integer that determines the sorting order of the item within its parent folder.
  • title: The user-defined name of the bookmark or folder.
  • dateAdded: The PRTime timestamp indicating when the bookmark was created.
  • lastModified: The PRTime timestamp indicating when the bookmark or folder was last changed.

Domain Optimization: moz_origins

To optimize database queries and calculate domain-level autocomplete suggestions, Firefox extracts the base domains from moz_places and stores them in moz_origins.

Key columns include:

  • id: The primary key referenced by moz_places.origin_id.
  • prefix: The protocol scheme of the site (e.g., http:// or https://).
  • host: The domain name (e.g., www.example.com).
  • frecency: The combined frecency score for the entire domain, used to suggest base URLs in the address bar.

Annotations and Downloads: moz_annos and moz_anno_attributes

Firefox uses an annotation system to attach arbitrary metadata to web pages and bookmarks. Most notably, file download history is stored here rather than in a dedicated downloads table.

  • moz_anno_attributes: Stores the names of the metadata types. Key columns are id and name (e.g., downloads/destinationFileURI or downloads/metaData).
  • moz_annos: Links the attributes to specific URLs. Key columns include place_id (linking to moz_places.id), anno_attribute_id (linking to moz_anno_attributes.id), and content (which holds the actual metadata, such as the local file path of a downloaded file and its completion time).
  • moz_items_annos: Functions identically to moz_annos, except it attaches metadata to bookmarks (moz_bookmarks.id) rather than URLs.

Address Bar Behavior: moz_inputhistory and moz_keywords

To tailor the address bar experience to the user's habits, Firefox utilizes two smaller tables that link user inputs to moz_places.

moz_inputhistory tracks what a user types into the address bar and which autocomplete suggestion they ultimately select:

  • place_id: Links to the selected URL in moz_places.id.
  • input: The exact text string the user typed (in lowercase).
  • use_count: A weight value that increases every time the user types that specific string and selects that specific URL.

moz_keywords stores custom shortcuts assigned to bookmarks, allowing users to type a short word in the address bar to navigate directly to a URL or trigger a custom search:

  • id: The primary key for the keyword.
  • keyword: The text shortcut defined by the user.
  • place_id: Links to the target URL in moz_places.id.