Microsoft Edge has been caught doing something every privacy conscious user should care about.
A researcher found that Edge was decrypting saved passwords and loading them into plain readable memory when the browser started, not just when you actually needed one for a login.
Microsoft first treated this as expected behaviour, because an attacker would already need access to your device or session. But that is exactly the point. If malware, a stolen session, or a compromised machine is already in play, leaving every saved password sitting in memory makes the damage far worse.
Microsoft is now changing Edge so saved passwords are only decrypted when needed, but the bigger lesson remains:
Do not use your browser as your main password manager.
Use a dedicated password manager.
Turn on 2FA.
Use passkeys where possible.
Avoid SMS for security codes if you can.
Do not confuse convenience with protection.
Your browser is for browsing. Your password vault deserves better.
What password manager do you trust most?
https://odysee.com/@AllThingsSecured:9/Your-browser-is-a-terrible-password-manager:e?fypId=3510106596
#Privacy #CyberSecurity #Passwords #MicrosoftEdge #PasswordManager #Passkeys #2FA #DigitalSovereignty
beitmenotyou1 / Michael J Burgess
npub123…58dpt
2026-05-23 19:58:29 UTC
Author Public Key
npub123j6zd6p5dls3qf2cae3dzqtrgl9vpd942jq6ge8l6mwr7muyy8qv58dptSeen on
wss://relay.nos.socialPublished at
2026-05-23 19:58:29 UTCEvent JSON
{
"id": "3a5d782c691e68267f1cc624abab1cf2a0f91e1364b759b89c539c997b7e9c66",
"pubkey": "5465a13741a37f08812ac77316880b1a3e5605a5aaa40d2327feb6e1fb7c210e",
"created_at": 1779566309,
"kind": 1,
"tags": [
[
"t",
"Privacy"
],
[
"t",
"CyberSecurity"
],
[
"t",
"Passwords"
],
[
"t",
"MicrosoftEdge"
],
[
"t",
"PasswordManager"
],
[
"t",
"Passkeys"
],
[
"t",
"2FA"
],
[
"t",
"DigitalSovereignty"
],
[
"client",
"Primal Web"
]
],
"content": "Microsoft Edge has been caught doing something every privacy conscious user should care about.\n\nA researcher found that Edge was decrypting saved passwords and loading them into plain readable memory when the browser started, not just when you actually needed one for a login.\n\nMicrosoft first treated this as expected behaviour, because an attacker would already need access to your device or session. But that is exactly the point. If malware, a stolen session, or a compromised machine is already in play, leaving every saved password sitting in memory makes the damage far worse.\n\nMicrosoft is now changing Edge so saved passwords are only decrypted when needed, but the bigger lesson remains:\n\nDo not use your browser as your main password manager.\nUse a dedicated password manager.\nTurn on 2FA.\nUse passkeys where possible.\nAvoid SMS for security codes if you can.\nDo not confuse convenience with protection.\n\nYour browser is for browsing. Your password vault deserves better.\n\nWhat password manager do you trust most?\n\nhttps://odysee.com/@AllThingsSecured:9/Your-browser-is-a-terrible-password-manager:e?fypId=3510106596\n\n#Privacy #CyberSecurity #Passwords #MicrosoftEdge #PasswordManager #Passkeys #2FA #DigitalSovereignty",
"sig": "cafcb9542df41972bfa34837730c1294cc0ea31430b1afdd8801fa81ec2a99e8699ff398dbb5121a6f82848cd278237e2e76073511816bf53205c05763e77a64"
}