Google-chrome – “Login Data” file in Chrome – retrieve logins/passwords/URL’s

decryptionencryptiongoogle-chromepasswords

I accidentally cleaned my Chrome passwords with some 3rd party software (yes I know – Im a genius!). I've never synced the passwords online. Still it seems that the data exists in "Login Data" file ( %LocalAppData%\Google\Chrome\User Data\Default\Login Data ). The good thing is that Im still on this machine and windows profile so I have the credentials and key to decrypt files with CryptProtectData (that's what I understood from other topics). This was the major issue when other people had similar question – they didn't have access to their original Chrome and Windows profile where the "Login Data" file came from.

a) I can see plain text URL's and logins in "Login Data" file

b) I could recover small part of passwords with (DPAPI DataProtectionDecryptor v1.10) https://www.nirsoft.net/utils/dpapi_data_decryptor.html (screenshots attached)

BUT – on one hand I have just logins and url's in large file ("Login Data") on the other hand I decrypted few but not related to logins or URL's …

I tried also other software:

a) DB Browser for SQLite (1 password retrieved because I added new pass not being aware that they were deleted) – so it's from "new" clean database

b) ChromePass v1.52
https://www.nirsoft.net/utils/chromepass.html

c) WebBrowserPassView v2.07
https://www.nirsoft.net/utils/web_browser_password.html

The software also see only new password even when I try different settings.

Helpfull topics that Im not able to understand technically:

https://www.thepythoncode.com/article/extract-chrome-passwords-python

How does Google Chrome store passwords?

Where are Google chrome passwords stored in windows?

Google Chrome. How to restore passwords from profile folder?

https://stackoverflow.com/questions/36300837/decrypt-master-password-of-windows-api-cryptprotectdata-presumably

I've read other topics on this matter but still cannot figure it out (Im NOT a developer). I cannot code but I understand some of it. I don't have servers installed, Im not on linux so please try to not paste line of codes in python for the answer.

Attached images:

Lots of passwords in password decryptor failed to decrypt

Even when it's decrypted I don't know what's the login and what's the URL

My DPAPI configuration

I can see data in "Login Data" file but I have no idea how to extract them and connect with decrypted passwords

Thank you in advance!
M.

Best Answer

Use This Tool: HackBrowserData

You can Recover your passwords using this tool:HackBrowserData

Hack-browser-data is an open-source tool that could help you decrypt data ( passwords|bookmarks|cookies|history ) from the browser. It supports the most popular browsers on the market and runs on Windows, macOS and Linux. This will decrupt Your Passwords and will store them in a simple .CSV fil

Statement: This tool is limited to security research only, and the user assumes all legal and related responsibilities arising from its use! The author assumes no legal responsibility!

Supported Browser

Windows
Browser Password Cookie Bookmark History
Google Chrome
Google Chrome Beta
Firefox
Microsoft Edge
360 Speed Browser
QQ Browser
Brave Browser
Opera Browser
OperaGX Browser
Vivaldi Browser
Internet Explorer

Download

Windows-64bit

Run

You can double-click to run, or use command line.

Related Question