Microsoft Edge stores all your saved passwords unencrypted in memory

A researcher found Microsoft Edge keeps all saved passwords decrypted in memory while the browser is running, even if they are not used in the current session.

Microsoft said this behavior is intentional and by design, and a prior report suggests it has been true for years.

The finding raises concerns for users on shared or exposed devices, because someone with local or admin access could potentially read stored credentials from RAM.

The issue also puts Edge’s password security claims under scrutiny and may make browser-based password storage feel less safe than many users expect.