Microsoft Edge loads every saved password into memory in plain text the moment the browser starts. Microsoft called it a deliberate design decision. Here is what happened and what to do about it.
What Was Found
In May 2026, Norwegian security researcher Tom Jøran Sønstebyseter Rønning showed that Microsoft Edge decrypts its entire password vault at startup and holds every saved credential in plain text in RAM for the full browser session. It does not matter whether you ever visit the sites those passwords belong to. They sit in readable memory from the moment Edge opens until it closes.
He tested every major Chromium-based browser. Edge was the only one that behaves this way. Chrome, Brave and the rest decrypt a password only at the moment it is needed, then remove it from memory.
He also published a proof of concept tool that pulls saved credentials straight from Edge’s process memory. It never opens the password manager and never triggers Edge’s authentication prompt. The prompt protects nothing when the passwords are already sitting decrypted in RAM.
Microsoft’s Response
When Rønning reported it, Microsoft told him this was a deliberate design decision, not a bug. A spokesperson said design choices in this area involve balancing performance, usability and security. Their suggested fix was to keep your device patched and run antivirus.
Read that again. The company learned its browser holds every saved password in readable memory and the official answer was: that is intentional.
Then the backlash hit. On May 18, Microsoft reversed course and announced that starting with Edge version 148, the browser will no longer keep all passwords loaded in unencrypted form. The fix only exists because a researcher went public. Without that pressure, this stays exactly as it was.
Why This Matters
Microsoft’s defense was that exploiting this requires the machine to already be compromised. Technically true and entirely beside the point. Infostealer malware is built to do exactly this: read credentials from browser memory and ship them to an attacker. Credential theft through infostealers grew 800% in the first half of 2025, with 1.8 billion credentials stolen from 5.8 million devices.
Plain text passwords in memory are how one compromised machine becomes ten compromised accounts. On shared machines and terminal servers it gets worse. An attacker with admin access can pull stored credentials from every logged in user running Edge at the same time.
What You Should Do
Stop storing passwords in your browser. Any browser. Edge users on version 148 or later get the fix, but the lesson stands either way: your browser vendor’s design choices are not made with your security first.
This is exactly why I keep pushing a dedicated password manager. A real one encrypts the vault with keys that never leave your device, requires authentication before revealing anything and does not load everything into memory at startup.
If you have not set this up yet, here is the path:
- Get a dedicated password manager: Why You Need a Password Manager (And How to Use One Right)
- Turn on two factor authentication everywhere it is offered: Two-Factor Authentication: What It Is and How to Set It Up
- Make the passwords themselves strong: Mastering Strong Passwords: A Real-World Guide for Real People
- If you manage servers, stop typing passwords entirely: SSH Keys: Stop Typing Passwords and Start Using Keys
Then go into Edge and delete every saved password. Settings > Profiles > Passwords. Clear it out.
Sources
- Mashable: Microsoft Edge storing passwords as plain text? Microsoft responds.
- PCWorld: Microsoft backtracks on Edge storing your passwords in plaintext RAM
- Linus Tech Tips forum: Edge stores saved passwords in plaintext in RAM upon start
- STACK Cybersecurity: Microsoft Edge Stores Your Passwords in Plaintext. What That Means.
Your Turn
Were you saving passwords in Edge? What did you switch to? If you are stuck picking a password manager, ask below and we will sort it out.