Why Firefox Requires Your OS Password to View Saved Logins

This article explains why the Mozilla Firefox web browser requires you to enter your operating system login password before allowing you to view or copy your saved plaintext passwords. It covers the security risks of unattended devices, how operating system authentication acts as a barrier against unauthorized access, the mechanics of how Firefox verifies your identity, and how this feature differs from Firefox's built-in Primary Password encryption.

Preventing Physical Snooping

The primary reason Firefox asks for your operating system (OS) password is to protect you from physical security threats. People frequently step away from their computers without locking their screens, or they lend their unlocked devices to friends, family, or coworkers.

Without this password prompt, anyone with brief physical access to your unlocked computer could open Firefox, navigate to the password manager, and click the "reveal" button to see all your sensitive logins in plaintext. By requiring the OS password, Firefox ensures that the person sitting at the keyboard is actually the owner of the computer.

Mitigating Remote and Screen-Sharing Risks

During remote support sessions or screen-sharing calls, another person might temporarily have control of your mouse and keyboard. If a malicious remote actor attempts to quickly extract your passwords through the Firefox interface, the OS password prompt acts as a roadblock. Because the remote user does not know your system login credentials, they cannot bypass the prompt to view or copy your passwords through the browser interface.

How the Verification Works

Firefox does not actually know or store your operating system password. Instead, when you click the eye icon to reveal a password or the copy button to copy it, Firefox sends a request to your operating system (such as Windows Security or macOS Authentication).

The operating system then steps in and asks you to verify your identity. Depending on your device, this might be your standard login password, a Windows Hello PIN, or a biometric scan like Touch ID. Once the OS confirms your identity, it sends a simple "pass" signal back to Firefox, which then reveals the plaintext passwords.

OS Password vs. Firefox Primary Password

It is important to understand that the OS password prompt is purely a user-interface barrier, not an encryption tool.

• OS Password Prompt: Stops someone from casually looking at your passwords inside the Firefox browser window. However, the password file stored on your hard drive remains unencrypted. Malware or a tech-savvy user with access to your system files could still extract the passwords without opening Firefox.
• Firefox Primary Password: Formerly known as the Master Password, this is an optional feature within Firefox. When enabled, it mathematically encrypts your saved passwords on your hard drive.

If you set up a Primary Password in Firefox, the browser will stop asking for your OS login password and will instead ask for your Primary Password, offering both physical snooping protection and hard-drive encryption.