Updated on May 18th, 2026: While Microsoft originally said the plaintext password behavior was “a deliberate design decision,” the company has now changed its tune. Starting with Edge version 148, the browser will no longer keep all passwords loaded in unencrypted form.
Original story from May 5th, 2026: If you tend to save your passwords in your browser, you need to be more careful. A security researcher from Norway has uncovered a serious vulnerability in Microsoft Edge that shows passwords are stored in memory as plaintext, as shown in this social media post.
Any malicious user with local access could easily intercept all your stored passwords, even if they haven’t been used at all during a given session. Attackers could simply retrieve and copy them in plaintext. In a video, Tom Jøran Sønstebyseter Rønning demonstrates it in action:
Serious flaw in Edge’s password manager
The vulnerability affects Microsoft Edge’s password manager. Password managers typically use end-to-end encryption and store passwords in cloud storage so that users can access them from anywhere. When passwords are needed, password managers normally decrypt the them for use and then delete them afterwards.
The fact that Edge keeps all passwords loaded without any encryption is both unusual and dangerous. Other password managers, including those that are built into browsers, don’t operate in this way—Rønning says Edge is the only Chromium-based browser he’s tested with this behavior.
Edge does require authentication to view passwords in the password manager, but this is of little protective value if attackers can simply gain access by reading the RAM, which is what happens here.
Is this intentional or a bug?
Rønning apparently shared his findings with Microsoft and received an unexpected response. According to ITavisen (machine translated), Edge’s password management behavior is “a deliberate design decision, “not a bug.” It’s unclear what benefit this design offers for users.
Rønning decided to warn users about how it works anyway, and also plans to publish his own tool on GitHub, which any user can use to check whether their Edge passwords are stored in plaintext.
If you use Edge and have passwords stored in the browser, you should migrate to another password manager that’s actually secure, then delete all your passwords from Edge. If you don’t know where to start, check out PCWorld’s picks for the best password managers.
