Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

I have the "Use Master Password" box checked, yet when I started Firefox up just now it is logging me in to my websites without ever having asked for it.

  • 3 replies
  • 1 has this problem
  • 1 view
  • Last reply by jdbear

more options

I tried terminating Firefox and restarting it just in case I was somehow mistaken, and still, Firefox is logging me in to my websites using my passwords without ever asking me for the master password.

I'm glad I have not stored any passwords to my financial accounts in Firefox.

I tried terminating Firefox and restarting it just in case I was somehow mistaken, and still, Firefox is logging me in to my websites using my passwords without ever asking me for the master password. I'm glad I have not stored any passwords to my financial accounts in Firefox.

Chosen solution

Are you sure you had previously logged out of those sites? If you hadn't logged out, the cookies which keep your session alive might still have been valid and in that case the site would let you in without having to use a saved password.

Read this answer in context 👍 1

All Replies (3)

more options

Chosen Solution

Are you sure you had previously logged out of those sites? If you hadn't logged out, the cookies which keep your session alive might still have been valid and in that case the site would let you in without having to use a saved password.

more options

Are you automatically reopening tabs and windows from the previous session via session restore?

  • Tools > Options > General > Startup: "When Firefox Starts": "Show my windows and tabs from last time"

Firefox stores cookies used in tabs that are currently open in the sessionstore.js file as part of saved session data, so those cookies will be restored if Firefox is closed without first closing these tabs.

You can set browser.sessionstore.privacy_level to 2 (never) or 1 (non-HTTPS) on the about:config page to disable saving cookies via session restore in the sessionstore.js file. The browser.sessionstore.privacy_level_deferred pref is used when you do not reopen the previous session automatically via "Show my windows and tabs from last time" and uses the same values.

You can open the about:config page via the location/address bar. You can accept the warning and click "I'll be careful" to continue.

more options

Yes, that was it, jscher - never logged out and existing cookies just resumed the prior session. That's fine for non-financial sites which these were. I have observed financial sites are diligent about automatically logging off old sessions, but it is good to be aware of this and be sure to be logged out of those sites when done.