firepwd

Firepwd.py, an open source tool to decrypt Mozilla protected passwords

31oct2025

Introduction

This educational tool was written to illustrate how Mozilla passwords (Firefox, Thunderbird) are protected using contents of files key4.db (or key3.db), logins.json (or signons.sqlite).

NSS library is NOT used. Only python is used (PyCryptodome, pyasn1)

This code is released under GPL license.

Now part of LaZagne project: https://github.com/AlessandroZ/LaZagne

You can also read the related article, in french: http://connect.ed-diamond.com/MISC/MISC-069/Protection-des-mots-de-passe-par-Firefox-et-Thunderbird-analyse-par-la-pratique

or this poster for the password crypto of key3.db and signons.sqlite.

Versions supported

• Firefox =32 (key3.db, logins.json)
• Firefox >=58.0.2 (key4.db, logins.json)
• Firefox >=75.0 (sha1 pbkdf2 sha256 aes256 cbc used by key4.db, logins.json)
• Firefox >=144.0 (https://github.com/lclevy/firepwd/pull/29) for logins.json using aes256 instead of 3des
• at least Thunderbird 68.7.0, likely other versions

key3.db is read directly, the 3rd party bsddb python module is NOT needed.

Warning

File firepwd.py is detected as "HackTool:Python/Stealer!AMTB" by Microsoft Defender, which is NOT a false positive.

Usage

By default, firepwd.py processes key3.db (or key4.db) and signons.sqlite (logins.json) files in current directory, but an alternative directory can be provided using the -d option. Do not forget the '/' at the end.

If a master password has been set, provide it using the -p option.

Valid verbose levels (-v) are from 0 (default) to 2.

…

Installation

pip install -r requirements.txt

Tested with python 3.7.3, PyCryptodome 3.9.0 and pyasn 0.4.8

Modules required:

• pyasn1, https://pypi.python.org/pypi/pyasn1/, for ASN1 decoding
• PyCryptodome, https://www.pycryptodome.org/en/latest/, for 3DES and AES decryption

Fork: firepwd-ng.py

A simplified script to decrypt Firefox passwords stored in the 'logins.json' file, using the master_key from 'key4.db'.

This script is based on the original work by @lclevy but has been refactored for clarity and simplicity, focusing only on modern Firefox versions that use key4.db and logins.json.

Reference documents

• Into the Black Box: A Case Study in Obtaining Visibility into Commercial Software, D. Plakosh, S. Hissam, K. Wallnau, March 1999, Carnegie Mellon University : http://www.sei.cmu.edu/library/abstracts/reports/99tn010.cfm
• Dr. Stephen Henson, August 4th 1999 : http://arc.info/?l=openssl-dev&m=93378860132031&w=2