Mobile devices based on Android have long turned into the main repositories of our digital life. From banking applications to social networks, authorization is required everywhere, and remembering dozens of complex combinations of symbols becomes physically impossible. That is why the system offers to save credentials, but few people think about exactly in which corner of the phone’s memory they end up and how reliably they are protected.
Understanding this where logins and passwords are saved in Androidis necessary not only out of curiosity, but also to ensure your own safety. Knowing the paths to system files allows you to competently create a backup copy of critical data or, conversely, to ensure that you remove traces of your activity before selling your gadget. In this article we will analyze in detail the architecture of storing access keys.
There are several levels of storage: from cloud services Googleaccessible from any device, to local system databases hidden from the eyes of the average user. Each method has its own vulnerabilities and advantages. We will look at them all so that you can choose the optimal access control strategy for your smartphone.
Google Smart Lock system storage and Autofill
The most common place where logins and passwords are saved in Android is the built-in system Google Smart Lock (or “Autofill” in new versions of the OS). When you enter data on a site or application and agree to have it stored, the information is encrypted and sent to the corporation's servers. This allows you to restore access even after a complete flashing of the device, if you log into your account.
Locally, this data is also cached in a protected memory section, access to which without root access is extremely limited. The system uses tokens for automatic authorization in applications, which saves the user from constantly entering PIN codes. However, if an attacker gains access to the unlocked screen, he can easily log into your accounts through the browser.
There is a special interface in the settings to manage this data. You can view the list of saved entries, edit them, or delete compromised passwords at any time. It is important to regularly check this list, as old or weak passwords pose a threat.
⚠️ Attention: The Google settings menu interface may differ depending on the version of Android and the manufacturer’s shell (MIUI, One UI, ColorOS). If you do not find the “Autofill” item in the standard path, use the search inside the settings menu.
To check the saved data, you must perform the following steps:
- 🔐 Open
Settingsyour smartphone and find the sectionGoogle. - 📱 Go to the tab
Autofilland selectAutofill from Google. - 📝 Click on the item
Passwordsto view a list of all sites and applications. - 👁️ To view a specific password, you will need to verify your identity through biometrics or a screen PIN.
Use the password checker feature in Google Settings to instantly find weak or reused character combinations and replace them.
Local databases of the Chrome browser
In addition to the system level, the browser Google Chrome has its own local storage. Even if synchronization with your account is disabled, the browser can save data in the local database SQLite. These files are located on the system partition, where access is only available to the superuser. The path to them usually looks like /data/data/com.android.chrome/app_chrome/Default/Login Data.
File Login Data contains not only the passwords themselves, but also the browsing history associated with the login forms. The data in this file is encrypted, but decryption keys are often stored on the same device, tied to a specific user profile. If you have root access, you can copy this file and try to decrypt it on your computer using a special utility.
Clearing browser data through the standard menu does not always delete the file completely; sometimes it is simply marked as free space until it is overwritten with new information. To guarantee the removal of sensitive data, you need to use secure erase tools or encrypt the entire device.
How to decrypt the Chrome database without root?
Without root access, it is almost impossible to decrypt the Login Data file on another device, since the encryption key is tied to the unique device identifier and Android user profile.
Main characteristics local storage in the browser:
- 💾 The file is stored in the format SQLite with an extension
.dbor without an extension. - 🔒 Encryption depends on the version of Android and the key protection mechanism used (KeyStore).
- 🗑️ When you uninstall the application, the data may remain in the partition
/data/data/until the sector is completely overwritten.
Third-party password managers and their storage
Many users prefer not to trust system data to corporations and use specialized applications such as KeePass, Bitwarden or 1Password. In this case, logins and passwords in Android are saved in the form of one encrypted container file or in the service’s cloud storage. Locally, only cache or temporary files can remain on the phone.
For example, KeePass2Android works with database files .kdbx. This file can be located in any folder of internal memory or on an SD card, which gives the user complete control. You decide where to save this file, and you can copy it to a flash drive, send it to your email, or keep it in a secure cloud.
The advantage of this approach is that even if your Google account is hacked, your passwords will remain safe, since they are protected by a master password that only you know. However, the loss of the master password means the permanent loss of access to all data, since it is technically impossible to restore them.
Using a local container file (for example, .kdbx) gives maximum control over the data, but requires the user to independently create backup copies of this file.
File system and root access
For advanced users with rights root, full access to the file system is available. In this case, the question “where are the login and passwords saved in Android” receives the most direct answer: in almost any application there is a folder databases or shared_prefs inside the directory /data/data/. This is where XML files and SQLite databases with settings and authorization tokens are located.
Access to this folder without superuser rights is closed at the Linux kernel level, on which Android is based. Obtaining root access removes these restrictions, allowing you to read, modify and delete any system files. This is a powerful tool, but it also reduces the overall security of the device, making it vulnerable to malware.
It is important to be extremely careful when working with the file system. Deleting the wrong file may result in a "bootloop" or loss of all application data. Always make a full backup of the partition /data/ before making any changes.
⚠️ Attention: Getting root access will void the warranty on the device and may disrupt the operation of banking applications (Google Pay, Samsung Pay), as they are blocked when a modified system is detected.
The data storage structure in applications is as follows:
| Data type | Location (path) | Storage format | Access without Root |
|---|---|---|---|
| Settings applications | /data/data/[package]/shared_prefs/ |
XML | No |
| Databases | /data/data/[package]/databases/ |
SQLite (.db) | No |
| Cache and temporary files | /data/data/[package]/cache/ |
Various | Partially |
| System keys | /data/misc/keystore/ |
Binary | None |
Backup and restore data
Understanding where data is saved is critical when moving to a new phone. The standard Google One backup procedure saves the list of apps, Wi-Fi settings, and passwords saved in Smart Lock. However, it does not always copy data within applications if the developer has not implemented support for the backup API. To completely clone a device, they often use tools like Xiaomi). These utilities can pack data from system folders
To fully clone a device, tools like Titanium Backup (requires root) or built-in migration features from manufacturers (e.g. Smart Switch from Samsung or MI Mover from Xiaomi). These utilities can pack data from system folders /data/ and transfer them to a new device, maintaining the file structure.
When restoring from a backup, it is important to make sure that the Android version on the new device is not lower than on the old one. Otherwise, conflicts may arise when trying to deploy old databases in a new environment, which will lead to errors in the operation of applications.
☑️ Checklist before resetting the phone
Security and protection of saved keys
Wherever your logins and passwords are saved in Android, the main protection is provided by screen locking and biometrics. Modern smartphones use a secure module TEE (Trusted Execution Environment), where cryptographic keys are stored. Without unlocking the device, it is impossible to access these keys, even if the memory is physically connected to another device.
However, the risk of phishing remains high. Malicious apps can imitate password entry windows or intercept keystrokes. Therefore, the use of two-factor authentication (2FA) is a mandatory addition to stored passwords. Even if an attacker steals a file with passwords, without the second factor he will not be able to log into the account.
Regularly changing master passwords and refusing to use the same combinations on different sites significantly reduces risks. Remember that no storage system is completely invulnerable, and the human factor is often the weak link.
What happens if I forget the master password for the storage?
If you are using a third-party application with local encryption (for example, KeePass) and forget the master password, it will be impossible to recover the data. Developers do not have access to your encryption keys. The only way out is to have a previously created backup copy of the database or key file.
Is it possible to transfer passwords to iPhone?
Yes, if you used a Google account to save passwords. All you need to do is install the Google or Chrome app on iOS, log into your account and enable synchronization. All saved data will be loaded automatically.
Where are Wi-Fi passwords stored?
Passwords for Wi-Fi networks in Android are stored in a file /data/misc/wifi/WifiConfigStore.xml (or .conf in older versions). This file can only be viewed with root access. In Android 10 and above, access to this file is even more limited.