Edge Stores Passwords Like Open Book as Plaintext Lingers in Memory

Norwegian penetration-testing specialist Tom Joran Sonstebyseter Ronning says Microsoft Edge 147.0.3912.98 decrypts every saved password at startup, with the data then sitting in process memory in plain text, according to his public demo and Microsoft’s response.

If browser password storage is supposed to work on a need-to-use basis, Edge’s behavior here does the opposite. Ronning’s claim is straightforward: every password a user has saved can be stored in process memory as plain text. More importantly, this is not a case where a password is briefly decrypted only when a login page needs it. In his testing, Edge unlocks the entire vault the moment the browser launches, and those plain-text passwords remain in memory instead of being cleared later.

The original report contrasts this with Chrome, which decrypts only a single password when needed, removes it after use, and adds encryption protections that raise the bar for local attacks. That difference changes the risk model entirely. In one case, everything is exposed up front; in the other, access is limited to what is needed at that moment, making bulk theft harder and more costly.

The key condition is local access. The research does not say a remote attacker can somehow pull your password vault out of thin air. It says that once someone has local access to the device, a simple memory dump can be enough to extract passwords in bulk. The risk is much higher on shared PCs, workplace terminals, or temporarily borrowed devices, where a convenience feature can quickly turn into an easy collection point.

Microsoft’s response is also important: this is intentional behavior designed to improve login performance, not a vulnerability. From a product perspective, that explanation is understandable. Fewer decryption steps can mean a smoother sign-in flow. But security design becomes much more fragile when convenience is made the default, especially when the data involved is an entire store of account passwords rather than disposable session data.

The broader debate is not really whether Edge is usable. It is whether a browser should still act as a master password vault at all. Ronning has already reported the issue to Microsoft, publicly demonstrated it, and plans to release a self-check tool. Industry advice is equally clear: move important accounts to a third-party password manager, then delete passwords saved in the browser. For users on a private personal machine with strong physical security, this may not be the most urgent issue. For anyone regularly moving between office PCs, laptops, and shared terminals, it should be taken much more seriously.

One practical checklist stands out. First, update Edge with the latest patch as Microsoft recommends to reduce risk. Second, review whether Edge is still storing high-value accounts such as email, payment, and work-system logins. Third, migrate those credentials to a dedicated password manager and enable two-factor authentication. The safest habit is not assuming nothing will go wrong, but removing the worst failure points before they matter.