Have you ever wondered where exactly Google saves all your passwords from sites, applications and services on your smartphone Android? This is not just an abstract “cloud” - behind each saved login there is a specific storage mechanism, system files and encryption protocols. In this article we will analyze in detail all the places where Google stores passwords on Android, from obvious (for example, Password Manager Chrome) to hidden (system databases SharedPreferences and Keystore).

It is important to understand: knowledge of these mechanisms will help not only find saved data, but also protect. from leaksexport it correctly when changing devices or restore it after resetting the settings. We will also touch on security issues - for example, why passwords from some applications (for example, banking) may not be displayed even in the Google Password Managerand how this relates to developer policies.

The article is relevant for all modern versions Android (from 10 to 15), but keep in mind: the interface and storage paths may vary slightly depending on the manufacturer (Samsung, Xiaomi, Pixel etc.) and versions Google Play Services.

1. Google Password Manager: main storage

The most obvious place where Google stores passwords on Android is the built-in Password manager (previously known as Smart Lock for passwords). your account Google and is available both on the phone and through the web interface passwords.google.comHere's how it works:

  • 🔑 Automatic saving: When you enter a password on a website or in an application, Android offers to save it. This data goes into an encrypted database Google Password Manager.
  • 🔄 Synchronization: Passwords are stored in the cloud and are automatically pulled up to all devices where you are logged in under the same account. account Google.
  • 🛡️ Encryption: Data is protected AES-256 and linked to your account. Without authorization, it cannot be retrieved.
  • 📱 Local copy: On the device, passwords are stored in encrypted form in the system. storage /data/data/com.google.android.gms/files/PasswordManager (access only for system processes).

To view saved passwords:

  1. Open Settings → Google → Google account management.
  2. Go to the tab Security → Password Manager.
  3. Authorize if necessary (you will need to enter a PIN code or fingerprint).
⚠️ Attention: If you use work or school Google account (for example, via Google Workspace), the administrator can limit access to Password Manager or block data export.
📊 How often do you use Google Password Manager?
Constantly
Only for important accounts
I prefer third-party managers
I never save passwords

2. Storing passwords in Google Chrome and other browsers

Google Chrome is the second most popular source of saved passwords on Android. It is closely integrated with Google Password Manager, but also has its own storage nuances:

  • 🌐 Local database: Passwords are stored in a file Login Data by path /data/data/com.android.chrome/app_chrome/Default/Login Data (available only through root or ADB).
  • ☁️ Cloud synchronization: If the option is enabled Synchronization → Passwords, the data is duplicated in the account Google.
  • 🔍 View in browser: Go to Chrome → ⋮ → Settings → Passwords.
  • 🚫 Restrictions: Some sites (for example, with autocomplete="new-password") block the saving of passwords.

Important: if you use other browsers (Firefox, Edge, Samsung Internet), they store passwords in their own databases. For example, Firefox uses logins.json in the user profile, and Samsung Internet system storage Samsung Pass (on devices Samsung).

Browser Path storage (Android) Synchronization Access without root
Google Chrome /data/data/com.android.chrome/... Yes (Google Account) Through browser settings
Mozilla Firefox /data/data/org.mozilla.firefox/... Yes (Firefox Account) Via about:logins
Samsung Internet System storage Samsung Pass Yes (Samsung Account) Via Settings → Samsung Pass
Microsoft Edge /data/data/com.microsoft.emmx/... Yes (Microsoft Account) Via edge://settings/passwords
⚠️ Attention: If you delete the browser or reset its settings, locally saved passwords (without synchronization) will be lost foreverAlways check if cloud synchronization is enabled.

3. Android system storage: where passwords are stored at the OS level

In addition to user interfaces, Android stores passwords in several system components This data is not directly accessible, but can be retrieved using ADB or root access:

  • 📁 SharedPreferences: Some applications store tokens and password hashes in XML files along the path /data/data/[package_name]/shared_prefs/. For example, Telegram stores encrypted session data here.
  • 🔐 Android Keystore: System key store (/data/misc/keystore/), where applications can store cryptographic keys, including those used to encrypt passwords.
  • 📱 Account Manager: System service android.accounts.AccountManager stores authorization tokens for accounts (for example, Google, Facebook) in the database accounts.db.
  • 🔗 Credential Manager: In Android 14+ a new API has appeared for managing credentials, which stores data in a secure container.

An example command for retrieving a list of accounts via ADB:

adb shell dumpsys account

Please note: access to these files without root restricted. Even if you gain physical access to the files (for example, through TWRP), the data will be encrypted using keys associated with the device.

How does encryption work in Android Keystore?

Android Keystore uses hardware security modules (for example, TrustZone or Titan M v Pixel) to generate and store cryptographic keys. These keys never leave the security chip, making them resistant to extraction even when physically accessing the device. Applications can use Keystore to encrypt data (including passwords) so that they can only be decrypted. the same device after unlocking (for example, using a fingerprint).

4. Application passwords: why some are not saved in Google

You may have noticed that passwords from banking applications (SberBank, Tinkoff), instant messengers (WhatsApp, Viber) or corporate services (Outlook, Zoom) often do not appear in Google Password Manager. Reasons for this:

  • 🏦 Security Policy: Banking applications prohibit Android saving passwords through the android:importantForAutofill="no" attribute in the manifest.
  • 🔒 Own storage: Messengers (for example, WhatsApp) store data in encrypted databases (msgstore.db.crypt14) and do not share them with the system.
  • 🛡️ Two-factor authentication: Many services require not only a password, but also OTP/biometrics, which makes saving them pointless in managers.
  • 📱 Using WebView: Some applications open web forms in an isolated WebViewwhere Android cannot intercept password entry.

To find out if an application stores passwords, check its manifest (AndroidManifest.xml) for the following flags:

android:allowBackup="false"

android:importantForAutofill="noExcludeDescendants"

⚠️ Attention: If the application uses biometric authentication (for example, a face scanner), its password can only be stored in Keystore and not be accessible even to the owner of the device. This is done to protect against phishing.

Open the password entry form in the application

Try to enter the data - will you be prompted to save?

View in Google Password Manager in 5 minutes

Check autofill settings in Android (Settings → System → Language and input → Autofill)

-->

5. Exporting and backing up passwords

If you want transfer passwords to a new device or create a backup copy, you have several options:

  1. Export via passwords.google.com:
    • 🖥️ Go to passwords.google.com v browser.
    • 🔧 Click ⋮ → Export passwords.
    • 🔐 Enter your account password Google.
    • 📄 Receive a file .csv with all saved data.
  2. Backup via Google Drive:
    • ☁️ Enable backup in Settings → Google → Backup.
    • 📱 Make sure that in the list of backup data there are Passwords.
  • Third-party managers (for example, 1Password, Bitwarden):
    • 🔄 Import passwords from Google to a third-party manager.
    • 🔐 Set up synchronization through their cloud.

    Important: file .csv with passwords not encrypted —store it in a safe place (for example, in an encrypted archive) and delete it after import.

    Method Data format Encryption Automation
    Export from passwords.google.com CSV No Manual
    Google Drive backup Binary (closed) Yes (AES-256) Automatic
    Third-party managers (Bitwarden) JSON (encrypted) Yes (-end-to-end) Manual/auto
    💡

    If you frequently reinstall firmware or test custom ROMs, set up automatic password backup via Tasker or AutomateThese applications can run scheduled exports and send the file to Google Drive or Telegram in encrypted form.

    6. Security: how to protect stored passwords from leaks

    Even if passwords are stored in encrypted form, they can be stolen through phishing, malware or vulnerabilities Android. data-i="237">: Set up device unlocking by

    • 🔐 Use hardware Keystore: Set up the device to be unlocked by PIN/biometrics - this will activate hardware encryption Keystore.
    • 🛡️ Disable autofill for critical services: Settings → System → Language and input → Autofill remove unnecessary services.
    • 📱 Check application permissions: If an application (such as a keyboard) requests access to AccessibilityService, it may intercept passwords.
    • 🔄 Change passwords regularly: Google Password Manager there is a function to check for leaks (passwords.google.com → Checking passwords).

    An example of a dangerous permission that can steal passwords:

    <uses-permission android:name="android.permission.BIND_ACCESSIBILITY_SERVICE" />

    If you suspect spyware is installed on your device, check the list of applications with access to Accessibility:

    1. Go to Settings → Accessibility → Installed services.
    2. Disable all suspicious applications (for example, keyboards from unknown developers).
    💡

    The most vulnerable point in the password storage chain on Android is not system storage, but applications with access to the AccessibilityService. Attackers often disguise keyloggers as “battery optimizers” or “notification managers.”

    7. Recovering passwords after resetting or breaking your phone

    If you have completed hard reset or the phone is broken, the chances of recovering passwords depend on whether they were synchronized with your Google account:

    • ☁️ Synchronized passwords: Available on passwords.google.com or a new device after authorization.
    • 📱 Local passwords (without synchronization):
      • If you had roottry extracting files from the backup TWRP.
      • For Samsung check Samsung Cloud (if backup was enabled copying).
    • 🔧 Application passwords: You can only restore through the recovery function of the application itself (for example, WhatsApp sends an SMS with a code).

    If synchronization was disabled, but root was not received, local passwords are lost forever. An exception is if you made a backup through Titanium Backup or similar tools.

    ⚠️ Attention: Services like “data recovery after reset” (for example, Dr.Fone or EaseUS) often promise to return passwords, but in practice they can only retrieve unencrypted data (for example, SMS or photos). They cannot recover encrypted passwords. Android they won't be able to restore it.

    FAQ: Frequently asked questions. about storing passwords in Google on Android

    Is it possible to see passwords from banking applications in the Google Password Manager?

    No, banking applications (SberBank, Tinkoff, VTB) block the saving of passwords through the flag android:importantForAutofill="no" in their manifest. This is a security requirement - passwords are only stored. in an isolated application storage or Keystore.

    How to transfer passwords from Android to iPhone?

    Export from passwords.google.com to a file .csv, then import it into iCloud Keychain or a third-party manager (for example, 1Password). Go to iPhone go to Settings → Passwords → Importing passwords.

    Why are some passwords in Chrome not displayed in Google Password Manager?

    This happens if:

    1. The password was saved in Chrome before authorization in the account Google (local storage).
    2. The site uses autocomplete="off" or new-password.
    3. You are logged in Chrome under another account Google.

    Check the synchronization settings in Chrome → ⋮ → Settings → Synchronization.

    Can I extract passwords from Android without root?

    Partially, you can:

    • Export passwords via passwords.google.com (only synchronized ones).
    • Use ADB backup to backup data Chrome or Password Manager, but the file will be encrypted.

    For full access to system files (Keystore, SharedPreferences) you need root or a vulnerability in the firmware.

    How to delete all saved passwords from Android?

    There are two ways:

    1. Through the Password Manager:
      • Go to passwords.google.com.
      • Select all passwords and click Delete.
  • Through factory reset:
    • Go to Settings → System → Reset settings → Delete all data.
    • Attention: this will delete all data from the device, including photos and applications.