How to Hack Your Firefox Master Password

If you're using Firefox's built-in password management, you should also be using its master password feature to protect your saved passwords from prying eyes. But what happens if you lose your master password?

Since the master password prevents anyone from accessing your saved passwords, you're out of luck if you lose your master password—that is, you can't access any of your saved credentials without it.



That's where the free, open source tool FireMaster comes in. FireMaster is a command line tool designed specifically to recover your master password from Firefox. Here's how to use it:

1. Download FireMaster and extract it to a folder on your desktop.
2. Open a command prompt. (Shortcut: Hit Win+R, type cmd, then hit Enter.)fire2
3. At the command prompt, change the FireMaster folder to your active directory. The quickest way to do this is to type cd , then drag and drop the FireMaster folder from your Desktop onto the command prompt—which will automatically fill in the path to that folder. Then just hit Enter.
4. Construct your FireMaster crack command. FireMaster supports a lot of different options, but you can speed up the process if you can narrow down a few points to customize your password cracking. For example, if you know you've only used alphabet characters (a through z), adding the following to your command can speed up a brute force attack significantly: -c "abcdefghijklmnopqrstuvwxyz" For the purpose of testing and providing an example, I wanted to see how long it would take for FireMaster to crack a password containing only letters (a through z) that I knew was exactly six characters long. The resulting command looks like this:

// Dictionary Crack
FireMaster.exe -d -f c:\dictfile.txt Firefox_Profile_Path

// Hybrid Crack
FireMaster.exe -h -f c:\dictfile.txt -n 3 -g "123" -s Firefox_Profile_Path

// Bruteforce Crack
FireMaster.exe -q -b -m 3 -c "ab12" -l 10 -p "pa??f??123" Firefox_Profile_Path

Example: FireMaster.exe -b -q -l 6 -c "abcdefghijklmnopqrstuvwxyz" -p "??????" %appdata%\Mozilla\Firefox\Profiles\1sq2zzh2.default

As you can see, I'm telling FireMaster to try a brute force crack on a 6-character master password using only the letters a through z. (You should read through the usage information to get a better idea of what options you've got for customizing the process to what you know about your password to speed things up.)

In the last part of the command, I'm pointing FireMaster to my Firefox profile folder, where the key3.db file exists (this is the file that contains the encrypted password information). The last folder in that path will differ for you, but everything up to that folder i.e., %appdata%\Mozilla\Firefox\Profiles\ will get you most of the way there. (If you only have one Firefox profile, you should just see one folder inside Profiles; use that folder.)(In folder options ,Enable the SHOW Hidden files and Folder and Appdata folder is in your username Folder )
5. After you've constructed your command, just hit Enter to get cracking. Using the command constructed above, FireMaster took roughly 23 minutes to crack my Firefox password. If I didn't know how long the password was, it would take significantly longer (you can offer a minimum and maximum password size to help narrow things down a little further). That said, it clearly wasn't all that difficult to crack my password given all I knew about it. It gets much harder the more secure your password is (think unusual characters and long passwords).