Google Chrome browser is the latest entry into the ongoing web browser war, mainly ruled by IE and Firefox. The word Google behind the Chrome has given it lot of hype and popularity than any other browser got in such a short duration. However some of the salient features such as searching from the same address bar, thumbnail view of top sites, private browsing etc makes it stand apart from other browsers in the market.

Like other browsers Chrome also has built-in login password manager functionality which keeps track of the login secrets of all visited websites. Whenever user logins to any website, he/she will be prompted to save the credentials for later use and if user chooses so, then the username & passwords will be stored in internal login database. So next time onwards whenever user visits that website, he/she will be automatically logged in using these stored credentials which saves hassle of entering the credentials every time.

Also user can opt to never store the credentials for a particular website. In such case that website is added to the exception list and user will never be prompted again to remember the password for that website.

Chrome maintains internal database for all the settings and book keeping things in the default profile location. Generally on pre-Vista machines the profile path is located below

Except the password field all other fields are entered in clear text. The password for all stored websites is encrypted using Triple DES algorithm seeded with logged on user's password. That means login secrets cannot be decrypted across the user or system boundaries unless under certain conditions.

Though this mechanism allows only logged on user to view his/her chrome secrets, it cannot prevent any malicious programs running on the system from stealing the user's chrome passwords. That way Firefox offers better security by providing option to set the master password to view the stored login passwords.

You can use any SQLite editor to view the contents of this login database file. Here is the snapshot of the SQLite Database Browser showing the contents of 'logins' table...

One can decrypt or recover the login secrets stored by Chrome using ChromePasswordDecryptor tool. This chrome password recovery application automatically detect the default chrome profile path for the current user and displays all the stored login credentials in clear text after decrypting them. It also shows all the blacklisted website entries added by the user. Export feature can be used to save the login secrets to the local file in HTML format.

Here is the snapshot of ChromePasswordDecryptor showing the decrypted login credentials....