01Location
- %APPDATA%\Mozilla\Firefox\Profiles\<profile>\places.sqlite
- ~/Library/Application Support/Firefox/Profiles/<profile>/places.sqlite
- ~/.mozilla/firefox/<profile>/places.sqlite
- ~/.config/mozilla/firefox/<profile>/places.sqlite
- ~/snap/firefox/common/.mozilla/firefox/<profile>/places.sqlite
02Questions it answers
- Which URLs were visited and when?
- Was a visit typed, from a link, a bookmark, a redirect, a download or a reload?
- Which files were downloaded and to which local path?
- What did the user type in the address bar to reach a page?
03Format and versions
| Format | SQLite 3 database (often with places.sqlite-wal). Visit dates are PRTime: signed 64-bit microseconds since 1970-01-01 00:00:00 UTC. |
|---|---|
| Applies to | Firefox main branch as read on 2026-10-14. Columns such as recalc_frecency, alt_frecency and triggeringPlaceId are recent; older profiles may lack them. |
04Key fields
| Field | What it tells you |
|---|---|
| moz_places (id, url, title, rev_host, visit_count, hidden, typed, frecency, last_visit_date, guid, origin_id) | One row per URL; also referenced by bookmarks through moz_bookmarks.fk. |
| moz_historyvisits (id, from_visit, place_id, visit_date, visit_type, source, triggeringPlaceId) | One row per visit; place_id → moz_places.id, from_visit → referring visit. |
| visit_type | 1 LINK, 2 TYPED, 3 BOOKMARK, 4 EMBED, 5 REDIRECT_PERMANENT, 6 REDIRECT_TEMPORARY, 7 DOWNLOAD, 8 FRAMED_LINK, 9 RELOAD. |
| source | Visit source: 0 organic, 1 sponsored, 2 bookmarked, 3 searched. |
| moz_inputhistory (place_id, input, use_count) | Text typed in the address bar and the place it led to. |
| moz_annos + moz_anno_attributes (downloads/destinationFileURI, downloads/metaData) | Download annotations on the source URL: local target file URI and JSON metadata (for example state, endTime, fileSize). |
| moz_bookmarks (id, type, fk, parent, title, dateAdded, lastModified, guid) | Bookmark tree; fk points to moz_places.id. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| moz_historyvisits.visit_date | PRTime: int64 µs since 1970-01-01 UTC | Bound directly from the visit time (PRTime) in History.cpp. |
| moz_places.last_visit_date | PRTime: int64 µs since 1970-01-01 UTC | Latest visit for the URL; can be NULL for places with no visits (for example bookmarks only). |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Copy places.sqlite with its -wal file and open the copy so pending transactions are included.
- Join moz_historyvisits.place_id to moz_places.id and divide visit_date by 1,000,000 for Unix seconds.
- Filter visit_type 7 and read the downloads/* annotations of the same place to rebuild downloads.
- Follow from_visit chains to reconstruct navigation paths and redirects.
07Interpretation pitfalls
- Download visits are recorded with the download start time as the visit date.
- frecency is a ranking score, not a count of visits.
- Rows can exist in moz_places without any visit, for example for bookmarks.
- A PRTime value divided by 1,000 gives milliseconds, by 1,000,000 seconds; confusing the two shifts dates by orders of magnitude.
09Sources
- Firefox source — toolkit/components/places/nsPlacesTables.h Mozilla (GitHub mirror) · checked 2026-10-14
- Firefox source — nsINavHistoryService.idl (TRANSITION_*, VISIT_SOURCE_*) Mozilla (GitHub mirror) · checked 2026-10-14
- Firefox source — toolkit/components/places/History.cpp Mozilla (GitHub mirror) · checked 2026-10-14
- Firefox source — toolkit/components/downloads/DownloadHistory.sys.mjs Mozilla (GitHub mirror) · checked 2026-10-14
- Firefox source — nsprpub/pr/include/prtime.h (PRTime) Mozilla (GitHub mirror) · checked 2026-10-14
- Profiles — Where Firefox stores your bookmarks, passwords and other user data Mozilla Support · checked 2026-10-14
- ForensicArtifacts — artifacts/data/webbrowser.yaml ForensicArtifacts project (GitHub) · checked 2026-10-14