Browser Database Decryption

A collection of Python scripts for decrypting saved credit card numbers and passwords stored by Chromium-based browsers and Firefox on Windows.

For educational and research purposes only. Only run these scripts against your own browser profiles.

---

Requirements

• OS: Windows only
• Python: 3.8+

Dependencies

pip install pycryptodome pyasn1 PythonForWindows

Package	Used by
pycryptodome	All scripts
pyasn1	decrypt_card_number_firefox.py
windows (PythonForWindows)	Chrome / Edge scripts

---

Scripts

1. decrypt_card_number_chrome.py

Decrypts saved credit card numbers from Google Chrome (v20+ App-Bound Encryption).

Requires: Administrator privileges

# Run PowerShell or CMD as Administrator
python decrypt_card_number_chrome.py

The script automatically reads from:

• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Local State
• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Web Data

---

2. decrypt_card_number_edge.py

Decrypts saved credit card numbers from Microsoft Edge (v20+ App-Bound Encryption).

Requires: Administrator privileges

# Run PowerShell or CMD as Administrator
python decrypt_card_number_edge.py

The script automatically reads from:

• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Local State
• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

---

3. decrypt_card_number_firefox.py

Decrypts saved credit card numbers from Mozilla Firefox. Uses the Windows Credential Manager to retrieve the OSKeyStore AES key.

Does not require Administrator privileges.

python decrypt_card_number_firefox.py -d "<path_to_firefox_profile>" [-p "<master_password>"]

Arguments:

Argument	Description	Required
-d, --dir	Path to the Firefox profile directory	Yes
-p, --password	Firefox master password (leave empty if none is set)	No

Finding your Firefox profile directory:

1. Open Firefox and go to about:profiles
2. Find your active profile and copy the Root Directory path

Example:

python decrypt_card_number_firefox.py -d "C:\Users\YourName\AppData\Roaming\Mozilla\Firefox\Profiles\abc123.default-release"

With a master password:

python decrypt_card_number_firefox.py -d "C:\Users\YourName\AppData\Roaming\Mozilla\Firefox\Profiles\abc123.default-release" -p "MyMasterPassword"

---

4. decrypt_chrome_v20.py

Decrypts saved passwords from Google Chrome (v20+ App-Bound Encryption).

Requires: Administrator privileges

# Run PowerShell or CMD as Administrator
python decrypt_chrome_v20.py

The script automatically reads from:

• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Local State
• %USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Login Data

---

5. decrypt_edge_v20.py

Decrypts saved passwords from Microsoft Edge (v20+ App-Bound Encryption).

Requires: Administrator privileges

# Run PowerShell or CMD as Administrator
python decrypt_edge_v20.py

The script automatically reads from:

• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Local State
• %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

---

How App-Bound Encryption Works (Chrome/Edge v20+)

Chrome and Edge v20+ protect stored data using App-Bound Encryption:

1. The master key is stored in Local State, encrypted with DPAPI under the SYSTEM account.
2. The scripts impersonate lsass.exe to gain SYSTEM privileges and decrypt the key via DPAPI.
3. Depending on the key blob flag, AES-GCM or ChaCha20-Poly1305 is used to decrypt the final master key.
4. Individual entries (passwords / card numbers) are then decrypted with AES-GCM using the master key.

This is why Administrator privileges are required for Chrome and Edge scripts.

How Firefox Encryption Works

Firefox uses two layers:

1. Master key — stored in key4.db, encrypted with PBE (3DES or AES-CBC via PBKDF2). Protected by an optional master password.
2. Credit card numbers — encrypted with AES-GCM using a 16-byte key stored in Windows Credential Manager under the label Firefox Encrypted Storage.