01Location
- <User Data>/<Profile>/Login Data
- <User Data>/<Profile>/Login Data For Account
02Questions it answers
- For which sites and user names did the browser store credentials?
- When was a credential saved, last used to sign in, last filled and last changed?
- For which sites did the user choose never to save passwords?
- Was a credential received from another user through password sharing?
03Format and versions
| Format | SQLite 3 database, main table logins. password_value is an encrypted BLOB; this record covers metadata only. |
|---|---|
| Applies to | Schema built incrementally from version 0; date_last_used added in 25, date_password_modified in 30, sharing metadata in 37, date_last_filled in 42 (Chromium main, 2026-10-14). |
04Key fields
| Field | What it tells you |
|---|---|
| origin_url, action_url, signon_realm | Page where the form was, form action URL and the realm used to match credentials. |
| username_element, username_value, password_element | HTML field names and the stored user name. |
| blacklisted_by_user | Set when the user opted never to remember passwords for this form. |
| times_used | Number of times the credential was used to authenticate in an HTML form. |
| sender_email, sender_name, date_received, sharing_notification_displayed | Shared-password metadata; sender_email is empty for credentials not received through password sharing. |
| insecure_credentials (parent_id, insecurity_type, create_time, is_muted) | Credentials flagged as insecure, linked to logins. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| date_created | int64 µs since 1601-01-01 UTC | When the login was saved by the browser. |
| date_last_used | int64 µs since 1601-01-01 UTC | Updated after a successful form submission; defaults to date_created. |
| date_last_filled | int64 µs since 1601-01-01 UTC | When the login was filled into a site, regardless of whether the form was submitted. |
| date_password_modified | int64 µs since 1601-01-01 UTC | Can be unset on older credentials; source code falls back to date_last_used or date_created. |
| date_received | int64 µs since 1601-01-01 UTC | When a shared password was received from another user. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy Login Data and Login Data For Account; record which store each row came from (profile or account).
- List logins with origin_url, username_value and the five time columns converted to UTC.
- Separate never-save entries (blacklisted_by_user = 1) from stored credentials.
- Correlate date_last_used and date_last_filled with History visits to the same origin.
07Interpretation pitfalls
- This record intentionally gives no guidance on recovering password values.
- Credentials can arrive through sync or sharing; date_created marks when this browser stored them, not when the account was created.
- Column availability depends on the schema version; zero values mean unset, not 1601-01-01.
09Sources
- Chromium source — components/password_manager/core/browser/password_store/login_database.cc The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — components/password_manager/core/browser/password_form.h The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — password_manager_constants.cc (Login Data file names) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — sql/statement.cc (BindTime / ColumnTime) The Chromium Authors (GitHub mirror) · checked 2026-10-14
- Chromium source — docs/user_data_dir.md (User Data Directory) The Chromium Authors (GitHub mirror) · checked 2026-10-14