How To Extract Plaintext Google Chrome Passwords

If any application is logged in on Google Chrome then how to get its password?

Hey man, i am in a pickle if you could assist i would be forever in your debt.

I have my login data file from my other SSD.
I created a new windows install on a m.2 and now cant run the decrypt on my original drive with the passwords on it. however i am able to optain the Chrome files. Any ideas. again any assistance would be so dank.

John, you explain in a way that is very understandable something so many people dont have the time/skills to do.I enjoy not only watching your vodeos but also just listening as you explain thoroughly i can almost visualise what you are doing.I hope you get to where you deserve to be pal !!!

How did the chrome decrypter know where to look to decrypt your passwords, did it just "know" to go straight to your locally saved ones or did you direct it there somehow

Is there any way I can see my gmail password on mac? I don't remember the password and it is not saved in password manager. Please help 🙏🥺🥺

So I have to leave the comment to let you know that you've helped so much. True could have happened with any video but just happened to hit yours first. My uncle passed away a week or so ago and he had a lot of cherished memories stored in his phone and laptop, I've learned to get through the windows password the pash couple of days probably through the least direct wya but this helped me to guess what his phone password was and get the remaining memories. Thank you for making the video and helping me recover the cherished memories.

Anyone know what it means to get this error message in command?

‘utf-8’ codec can’t decode byte 0xf6 in position 1: invalid start byte
[ERR] Unable to decrypt, Chrome version <80 not supported. Please check.
Sequence: 192

It shows almost 200 of these, and was only able retrieve me 1 password.

If i accidentally deleted one chrome account , should i see it throught this method ?

How can we access \ get the code shown in the video ? any help anyone ?

It freaking worked!!! I can't believe it, woohoo I'm so excited!!! Do you know that I have been searching for 5 days now trying to restore my damn passwords??? downloading data recovery software and password decryptor software that didn't work... posted on forums, people telling me I couldn't do it and I finally figured it out!!! Wow... that was such hard work... and I am a first time user of all of this, never opened command or terminal a day in my life, it took me so long to understand all of this stuff. PHEW!!!

And thats why I dont save passwords anywhere. I have a password algorithm in my head that creates a random string pass, upper/lower case, numbers, etc for each site. Don't need to remember them that way. If it ends up on a hacked password dump, it won't work on any other site and looks like a long random string.

You showed how to get the secret key but then you decrypted your own live database

I lost my trust in browser password managers when I first gained root access to workstation terminals on an ldap network. Back then the passwords were still stored in plaintext for both firefox and chrome. Obviously some people would use workstations to access social media, or maybe their bank, and I definitely wouldn't have trusted everyone else with root with that level of access. On one hand I'm happy the barrier to entry is slightly higher, so someone like me who thought I was a Linux god because I knew a handful of tar command flags can't figure it out, on the other hand... still yikes.

hey if i did not trust big company as google how i can trust simple free tool like passbolt ??

How to do this one a userdata file from a user that is not the current user?

The "pypiwin32" doesn't install in my macos. As I couldn't able to run this script. Any suggestions to recover it.

What about Firefox? 🤔

i use bitwarden

Great video John but could you help me real quick? I tried following along but got the following errors when I initiated the final decryption step: “CryptUnprotectData”, “Key not valid for use in specified state” and “Chrome secretkey cannot be found” . Please help. Thanks

This is really only an issue on one platform: Windows. Windows is the only mainstream OS to not provide per-application secure storage. As an example, on Windows it is impossible for your browser to prevent a random download from accessing all stored passwords/cookies. This is a primary reason account hijacking is popular on Windows but not on other platforms.

Linux has AppArmor/SELinux (though often unused), MacOS has keychain, iOS & Android has app-isolated storage by-default for every app, and ChromeOS uses the same-origin-policy.

But doesnt the hacker need a physical access to the PC, to be able to view any of this? I guess this is important if you are prone to forgetting your Laptop to places?

If you still a little slow in keeping up with this guy, like me, it really helps to slow the video down a notch or two in the settings 😢

Initialisation
Vector
E*crypt3dpssword

Cipher scan ?

microsoft edge is IE

Winpeas can also pull browsers password

Thanks. Combined with discord hooks system, you can do some social engineering.

in windows environments , the encryption keys is located in the "local state" file , that is a huge security risk , in the other hand , in macos environment ,the encryption key in located in the keychain App , so in order to get the encryption key , first you need to unlock the keechain app .

Do you know what version of chrome this works for? Didn’t work for me it did pull all sites and usernames though

Would I be wrong to assume that copying the whole google chrome folder into a Linux machine and running the script would get the same results? Don’t love running scripts that I don’t know everything it’s doing. Wish I knew everything ha

Its pronounced Sql not sequel...ppl should learn that

Passbolt (and any other password manager) employs the similar mechanisms for storing and sharing passwords as your browser password manager, it just has a robust feature set for sharing the password with others. Don't get lazy and believe any password manager is a golden bullet.

Passwords are stored using a cipher, which will take a long time to break if you were to brute force it, but the key to the cipher needs to be kept on your local machine in order to access them.

The best way to protect yourself is to use multiple layers of authentication. 2FA authenticator applications, NFC tags, biometrics. Separate storage or data mediums that can have a hash created, so only the medium itself is a way to authenticate. Employ good practice and having multiple layers of security is the best way to keep you and your data protected.

omg

I have a question if we use metaspoit and get the password login file of chrome how can we decrypt them locally I couldn't find anything about it

Talk normal. Really not liking what you are evolving into. Even your thumbnails are turning cringe.

I don't think there is a better solution. They can't put the encryption key on their servers. Also, secure your computer, don't download things from unknown emails or sources. Don't disable the UAC.

this is why hackers can ttake control over YT channels this days.

Yeah, totally true. However, the scenario assumes the attacker is running the script with same privileges as the victim. Most malware run with that privileges I suppose, but think it is important to mention.

What if your PC explodes or something? You will probabaly say that you can recover your passwords from another PC, but then you need a password for that, that will access all your passwords, so what's the point?

i used this video well

A easier solution is to go to the website of the stored password, let it auto fill it, and change the HTML to show the starred contents.

Did I hear god forbid I.e

John something you just need to keep quiet about you're smart guy why don't you just put your debit card out there and let every viewer use it because I use Google I'm pissed someone with your intelligence show the dark web exactly how to crack passwords of Chrome browser

Awesome content and very informative! 🙌

10 min of video, 2 min of sponsor 😅

hi i have question can you plz answer ? chrome save my Gmail account but i forget my Gmail password now i want to look it up in autofill option but there is no Gmail password mention all other save passwords are available but there is no gmail password is showed what i suppose to do ?

Is there a way to make Google stop asking me if I want to save the password? go to site - login - google asks if I want to save - I answer Never. Next time - same site - get asked again. What part of never is google not understanding?
Also - "press the I believe button". LOL I have not heard that phrase since nuclear power training school in the 80s. :)

I see on their website that you can run this in docker but will it also run in proxmox ?