Quick answer: Thunderbird saved passwords are stored in the Thunderbird profile folder. The main password file is logins.json (encrypted passwords) with the master key in key4.db. The default Thunderbird password location is: C:\Users\[YourUsername]\AppData\Roaming\Thunderbird\Profiles\[profile-name]\
If you're searching for Thunderbird saved passwords or Thunderbird profile credentials, you likely need to backup your email credentials before reinstalling Windows, migrate to a new computer, or recover forgotten email passwords. This guide shows you exactly where Thunderbird stores passwords AND how to extract them without manual decryption complexity.
When Thunderbird Passwords Can Be Recovered
Thunderbird passwords are recoverable as long as both the profile folder and encryption keys exist. The success depends on what happened to the computer:
- Moving to a new computer → Recoverable
- Windows reinstalled → Usually recoverable
- Profile corrupted → Recoverable
- External drive access → Recoverable
- Forgotten Master Password → Not recoverable
- Formatted drive → Not recoverable
This guide covers each scenario so you know recovery chances before attempting extraction.
In This Tutorial Guide
- Exact Thunderbird Password Location (All Windows Versions)
- Thunderbird File Structure: Understanding logins.json and key4.db
- Method 1: Thunderbird Built-in Password Manager (Works When Thunderbird Opens)
- Method 2: Manual Profile Backup (Simple - But Passwords Stay Encrypted)
- Method 3: Manual Password Extraction (Complex - 12+ Steps)
- Why Thunderbird Passwords Are Hard to Extract Manually
- The Simplified Solution: Automated Thunderbird Password Recovery
- Manual vs Automated: Time & Complexity Comparison
- Step-by-Step: Recover Thunderbird Passwords in 60 Seconds
- Special Scenarios: Dead PC, Corrupted Profile, Forgotten Master Password
- Frequently Asked Questions
- Conclusion: Stop Hunting, Start Recovering
Exact Thunderbird Password Location on Windows 10/11
Thunderbird stores all email account passwords, server credentials, and authentication data in your Windows user profile. Here is the complete path breakdown:
Primary Thunderbird Password Location:
C:\Users\[YOUR_USERNAME]\AppData\Roaming\Thunderbird\Profiles\
Thunderbird Password Files:
└── [random-profile-name].default-release\ # Main profile folder
├── logins.json # Contains encrypted usernames and passwords
├── key4.db # Master encryption keys (Thunderbird 60+)
├── cert9.db # Certificate database
├── prefs.js # Thunderbird preferences
└── places.sqlite # Other browser data (not passwords)
Example Actual Path:
C:\Users\JohnDoe\AppData\Roaming\Thunderbird\Profiles\abc12345.default-release\logins.json
Quick Access Shortcut
Press Win + R, type %APPDATA%\Thunderbird\Profiles\ and press Enter. This opens the folder containing all your Thunderbird profiles where password files are stored.
Alternative: Find Profile Location from Thunderbird
- Open Thunderbird
- Click Menu (☰) → Help → Troubleshooting Information
- Look for "Profile Folder" section
- Click "Open Folder" - this opens your exact profile location
Thunderbird File Structure: Understanding logins.json and key4.db
To understand stored email logins, you need to know what each file does:
{
"nextId": 5,
"logins": [
{
"id": 1,
"hostname": "imap.gmail.com",
"httpRealm": "Gmail IMAP",
"formSubmitURL": "",
"usernameField": "",
"passwordField": "",
"encryptedUsername": "MDoEEPgAAAA...",
"encryptedPassword": "MDoEEPgAAAA...",
"guid": "{abc123...}",
"encType": 1,
"timeCreated": 1707753600000,
"timeLastUsed": 1707753600000,
"timePasswordChanged": 1707753600000,
"timesUsed": 1
}
]
}
key4.db - SQLite database containing master encryption keys
Tables:
├── metadata # Database version info
├── keys # Encrypted master keys
└── keys2 # Additional key storage
How Thunderbird Encryption Works
Thunderbird uses the Mozilla NSS (Network Security Services) library for encryption. The process is:
- key4.db contains encrypted master keys (protected by your Windows login)
- logins.json stores usernames/passwords encrypted with those master keys
- Both files are required to decrypt passwords
- Without key4.db, logins.json is completely unreadable
Why logins.json Alone Is Useless
The usernames and passwords inside logins.json are encrypted using keys derived from key4.db via the Mozilla NSS cryptographic library. Without initializing the NSS security database, the encrypted fields cannot be decrypted.
This is why copying only logins.json or opening it in a text editor will never reveal passwords — the database must be processed together with its security context.
Method 1: Thunderbird Built-in Password Manager (Works When Thunderbird Opens)
Difficulty: Beginner - 2 minutes
Works for: Viewing individual passwords when Thunderbird is working
If Thunderbird opens normally, this is the easiest way to view stored email logins.
Step 1: Open Thunderbird Password Manager
- Open Thunderbird
- Click Menu (☰) → Settings → Privacy & Security
- Scroll down to "Passwords" section
- Click "Saved Passwords" button
Step 2: View Passwords
Click "Show Passwords" and confirm. All your saved email credentials will be displayed.
When This Method Fails
- ❌ Thunderbird won't open (corrupted profile)
- ❌ You've forgotten your Master Password
- ❌ Need to recover from dead PC/external drive
- ❌ Need to export ALL passwords at once (no bulk export)
- ❌ Thunderbird profile is damaged
Browser-based email clients store credentials differently. For comparison see: Firefox saved passwords location.
Method 2: Manual Profile Backup (Simple - But Passwords Stay Encrypted)
Difficulty: Beginner - 5 minutes
Works for: Creating a backup, but passwords remain encrypted
This method backs up the entire Thunderbird profile, including password files. It's good for disaster recovery but doesn't let you view passwords.
Step 1: Locate Thunderbird Profile
Press Win + R, type %APPDATA%\Thunderbird\Profiles\
Step 2: Copy the Profile Folder
Find your profile folder (ends in .default-release). Copy the entire folder to a safe location (USB drive, external HDD, cloud storage).
Step 3: Restore When Needed
To restore, replace the profile folder on your new Thunderbird installation with your backup.
The Problem with Profile Backup
This method does not give you readable passwords. If you need to access individual passwords (e.g., for mobile device setup, sharing with someone, or if Thunderbird won't restore properly), you're stuck with encrypted files you can't read.
You may also want to backup browser logins: export Chrome passwords without sync.
Method 3: Manual Password Extraction (Complex - 12+ Steps)
Difficulty: Expert - 45-60 minutes
Success Rate: ⚠️ 50-70% (depends on Thunderbird version)
This method involves extracting passwords directly from logins.json and key4.db using command-line tools and decryption scripts.
Manual Decryption Process (Overview):
Step 1: Locate Thunderbird profile folder
Step 2: Copy logins.json and key4.db to working directory
Step 3: Install Python and required libraries:
Step 4: Download Mozilla NSS tools or use Python script
Step 5: Extract master key from key4.db:
Step 6: Decrypt logins.json using master key
Step 7: Parse JSON output
Step 8: Manually record each username/password
# Example Python snippet (simplified - actual code is much longer)
import json
import sqlite3
from Crypto.Cipher import AES
# This is NOT a complete working script
# Full decryption requires NSS library integration
# and handling of multiple encryption formats
Why Manual Extraction Fails for Most Users
- Requires Python programming knowledge
- Need to understand Mozilla NSS cryptography
- Different Thunderbird versions use different encryption
- Master Password adds another layer
- Scripts from forums may contain malware
- 60+ minutes of technical work
Why Thunderbird Passwords Are Hard to Extract Manually
Unlike some applications that store passwords in plain text, Thunderbird uses enterprise-grade security. Here's what makes manual extraction difficult:
Triple Encryption
Thunderbird uses 3DES encryption wrapped in PKCS#11 standards, with master keys protected by Windows DPAPI or Master Password.
SQLite + JSON
Keys are in SQLite, passwords in JSON. Two different formats requiring different tools to read.
Version Changes
Thunderbird 60+ uses key4.db, older versions used key3.db. Different encryption algorithms.
Master Password
If set, all passwords are encrypted with a user-provided password, making decryption impossible without it.
Choosing the Right Method
- If Thunderbird opens → use built-in password viewer
- If moving computers → copy full profile folder
- If profile damaged → database extraction required
- If you need all passwords quickly → automated scanning helps
This article includes both manual and automated approaches so you can choose what fits your situation.
The Simplified Solution: Automated Thunderbird Password Recovery
Advanced Password Recovery Suite
The Complete Thunderbird Password Solution
PC Trek's Advanced Password Recovery Suite (APRS) automates the entire Thunderbird password recovery process. Instead of manually hunting for Thunderbird saved passwords and fighting with encryption, APRS does it all in seconds.
What APRS Automates:
- ✓ Finds all Thunderbird profiles automatically
- ✓ Locates logins.json and key4.db files
- ✓ Handles key3.db (legacy) and key4.db (modern)
- ✓ Decrypts all email passwords instantly
- ✓ Supports Master Password (prompts when needed)
- ✓ Works with corrupted Thunderbird installations
- ✓ Recovers from external drives (dead PCs)
- ✓ Exports to CSV, HTML, TXT
What You Don't Need:
- ✗ No Python scripts or coding
- ✗ No SQLite knowledge
- ✗ No NSS library troubleshooting
- ✗ No manual JSON parsing
- ✗ No version compatibility worries
- ✗ No 60-minute time investment
- ✗ No risk of malware from forums
How APRS Solves the Problem
APRS includes the complete Mozilla NSS library stack, properly initializes the cryptography modules, and handles all the complex decryption steps automatically. It's like having a Thunderbird password expert in a single click.
✓ Free trial shows ALL recoverable Thunderbird passwords ✓ No registration ✓ 100% local
Manual vs Automated: Time & Complexity Comparison
| Task | Manual Method | PC Trek APRS |
|---|---|---|
| Find Thunderbird profile folder | 5-10 minutes Navigate to %APPDATA%, identify correct profile |
1 second Auto-detected |
| Locate password files | 2-5 minutes Identify logins.json, key4.db |
Auto Instant scanning |
| Extract master key | 15-20 minutes SQLite queries, NSS tools |
2 seconds Automatic extraction |
| Decrypt passwords | 20-30 minutes Python scripts, cryptography |
3 seconds One-click decryption |
| Export credentials | 10 minutes Manual copy/paste each password |
10 seconds One-click export |
| TOTAL TIME | 45-75 minutes | 60 seconds |
| Technical skill required | Advanced Developer | None - Beginner friendly |
Step-by-Step: Recover Thunderbird Passwords in 60 Seconds with APRS
Step 1: Download and Install APRS
Download Advanced Password Recovery Suite. The free trial shows all recoverable Thunderbird passwords.
Download APRS Free TrialStep 2: Launch and Select Thunderbird
Open APRS. From the application list, select Mozilla Thunderbird. The tool automatically:
- Scans for all Thunderbird profiles
- Detects logins.json and key4.db/key3.db
- Checks for Master Password protection
- Prepares for decryption
Step 3: Enter Master Password (If Applicable)
If you set a Master Password in Thunderbird, APRS will prompt you for it. This is required for decryption.
Step 4: View Decrypted Passwords
Within seconds, all your Thunderbird email credentials appear in a clean table showing:
- Server/Hostname — imap.gmail.com, mail.yahoo.com, etc.
- Username — Your email address/login
- Password — Decrypted plain text
- Created Date
Step 5: Export and Save
Click Export and choose your format:
- CSV — For Excel, password managers
- HTML — Readable, searchable backup
- TXT — Simple text file
Special Scenarios: Dead PC, Corrupted Profile, Forgotten Master Password
- Connect the dead drive to a working PC via USB adapter
- Launch APRS and select "Scan external drive"
- Navigate to the Thunderbird profile folder on the dead drive:
E:\Users\[Username]\AppData\Roaming\Thunderbird\Profiles\ - APRS decrypts passwords from the offline Thunderbird installation
Success rate: ~95% if profile files are intact.
APRS reads the password files directly from disk, bypassing Thunderbird entirely. Even if Thunderbird is completely broken and won't launch, APRS can still extract and decrypt all passwords as long as logins.json and key4.db are readable.
Technician Tip: Migrating Thunderbird to Another PC
To fully transfer accounts, copy the entire profile folder — not only password files. Thunderbird stores server settings, certificates, and identities together. Moving only logins.json and key4.db will not recreate accounts automatically.
Frequently Asked Questions
C:\Users\[YourUsername]\AppData\Roaming\Thunderbird\Profiles\[random-profile].default-release\logins.jsonThe master encryption keys are stored in
key4.db in the same folder. To access this folder quickly, press Win + R, type %APPDATA%\Thunderbird\Profiles\ and press Enter.
- From Thunderbird: Menu → Help → Troubleshooting Information → Profile Folder → Open Folder
- Quick access: Press Win+R, type
%APPDATA%\Thunderbird\Profiles\ - Manual: Navigate to C:\Users\[Username]\AppData\Roaming\Thunderbird\Profiles\
- key3.db: Used by Thunderbird versions before 60 (older, legacy format)
- key4.db: Used by Thunderbird 60 and newer (modern encryption)
APRS supports both formats automatically. If you have an old backup with key3.db, APRS can still recover your passwords.
Conclusion: Stop Hunting for Thunderbird Password Files
Now you know exactly where stored email logins are located and what the password files are. But more importantly, you understand why knowing the location is only the first step in a complex, multi-step manual process.
The reality of manual Thunderbird password recovery:
- ✅ You can find the files (logins.json, key4.db)
- ✅ You can back up the profile folder
- ❌ You CANNOT easily read the passwords without complex decryption
- ❌ Manual methods require programming and 45-75 minutes
- ❌ One mistake and you're starting over
For webmail accounts accessed via browser, see: recover Chrome stored passwords.
The smart solution: Let PC Trek's Advanced Password Recovery Suite handle all the complexity automatically. In 60 seconds, you'll have a complete, decrypted backup of every Thunderbird email password — ready to export, store, or use immediately.
Ready to Recover Your Thunderbird Passwords?
Stop fighting with encryption and scripts. Download the free trial and see every Thunderbird email password on your system in under 60 seconds.
✓ Free trial shows ALL recoverable Thunderbird passwords ✓ Works on dead drives ✓ Handles Master Password ✓ 100% local