Edge stops loading saved passwords in plain text at startup

Microsoft will change Edge so saved passwords are no longer loaded into memory in clear text at browser startup. Passwords will be decrypted only when the browser performs autofill or password management tasks. The update is available in the Canary channel and is being prioritized for Stable, Beta, Dev, Canary and Extended Stable builds 148 and newer.

A researcher reported that the previous behavior decrypted the entire saved‑password store at startup and kept credentials in clear text in process memory for the duration of the session. The researcher noted, “Edge is the only Chromium‑based browser I’ve tested that behaves this way. By contrast, Chrome uses a design that makes it far harder for attackers to extract saved passwords by simply reading process memory.”

Microsoft initially designed Edge to load saved passwords at startup but has revised the approach. Gareth Evans, Microsoft Edge Security Lead, described the change as a defense‑in‑depth improvement and added: “Going forward, Microsoft Edge will no longer load all saved passwords into memory at browser startup. Instead, passwords will be decrypted only when needed for autofill or password management operations.”

Microsoft said narrowing when passwords are decrypted reduces the time credentials appear in clear text in process memory and brings Edge’s behavior closer to other Chromium browsers. The company said the change should lower the chance that an attacker can harvest all saved passwords by reading process memory.

Security guidance accompanying the update recommends enabling multi‑factor authentication where available, avoiding storage of payment card details and sensitive personal data in a browser vault, and disabling autofill for sites that hold highly sensitive accounts. Users who prefer can use dedicated password managers instead of the browser’s built‑in manager.

The Canary channel already shows the new behavior. Microsoft said other channels will receive the update in upcoming builds 148 and newer.