stop letting Chrome remember your passwords

why chrome's password manager is a juicy target

every infostealer malware family you've ever heard of, redline, raccoon, vidar, lumma, all of them have one thing in common: step one is grab the browser's saved logins. chrome, edge, and brave all store that stuff in a local sqlite database, and while it's technically "encrypted," the decryption key is sitting right there on your machine too. if malware runs as you, it can just ask windows or macos to decrypt it on the spot. no cracking required. it's less a vault and more a sticky note with a lock on it that you also have the key to, taped right next to it.

that's why moving your passwords into a real password manager and cleaning up after yourself isn't paranoia, it's just basic hygiene. here's the actual workflow.

step 1: export, but know what you're holding

in chrome, go to settings > autofill and passwords > password manager > settings > export passwords. it'll spit out a csv file. that file is 100% plain text. every username, every password, every url, sitting there readable by anything on your system, including whatever just infected it if you're mid-compromise. treat this file like it's radioactive the second it hits your downloads folder. don't email it to yourself, don't drag it to a cloud drive, don't let it sit around "just for a bit."

step 2: import into something built to hold secrets

bring that csv into bitwarden, 1password, or vaultwarden if you're self-hosting. all three support csv import directly in their vault settings. this is the actual upgrade: these tools encrypt your vault locally before anything syncs, they support strong master passwords plus 2fa, and they're built from the ground up to be a credential store, not a side feature bolted onto a browser. take the extra five minutes here to also turn on two-factor auth on the password manager itself. your vault is now the single most important login you own, treat it that way.

step 3: shred the evidence

once you've confirmed the import worked, that plain-text csv needs to be gone, not just deleted. a normal delete just removes the file's pointer, the data is still sitting on disk until something overwrites it, and recovery tools can pull it back. that's where shred comes in on linux and mac (via coreutils).

shred -u exported_passwords.csv

breaking that down:

shred overwrites the file's contents multiple times with junk data before anything touches the file table, so even if someone recovers the file, they get garbage, not your logins.

-u tells it to delete the file after shredding, so you're not left with an empty husk sitting in your downloads folder reminding everyone it used to matter.

on windows, you don't have shred by default, but sysinternals' sdelete does the same job: sdelete -p 3 exported_passwords.csv overwrites it three passes before removal. either way, don't just hit the delete key and call it done.

step 4: shut the door in chrome

last step, go back into chrome's password manager settings and turn off "offer to save passwords." while you're in there, check "saved passwords" and delete anything still sitting there from before you made the switch. this matters because even after you've moved everything to your new vault, chrome will happily keep offering to save new logins unless you tell it to stop, and you'll end up right back where you started in six months.

also worth checking: clear your browser's autofill data for payment methods and addresses while you're in these settings. same logic applies, local plain-text-ish storage that malware loves to scrape.

the takeaway

this isn't about chrome being "bad," it's about browsers being built for browsing, not secrets management. a dedicated password manager gives you encryption at rest, zero-knowledge architecture, and actual security auditing that a browser's bolted-on feature never will. the whole move takes maybe twenty minutes: export, import, shred, turn off the setting. do it once, and you've closed off one of the most common first moves an attacker makes against regular people. send this to the person in your life who still has chrome autofilling their bank login.