Mozilla

Firefox stores saved login credentials within user-specific profile directories, typically found under .mozilla/firefox/<profile_id>.default. Within these directories, logins.json contains the encrypted credentials, while key4.db holds the associated encryption keys required for decryption.

firepwd.py is an open-source Python tool used to decrypt saved Firefox and Thunderbird credentials by processing logins.json and key4.db (or older formats like key3.db and signons.sqlite). It performs decryption without relying on the NSS library, supports Firefox versions up to ≥75, and is now integrated into the LaZagne project.

# Point it to the directory
python firepwd.py -d /c/Users/lclevy/AppData/Roaming/Mozilla/Firefox/Profiles/o8syoe2h.default/

# Run it from where files are
python firepwd.py