I Looked Up How Long It Takes to Crack a Firefox Password in 2026. Then I Changed My Browser.

Firefox uses 60x fewer security iterations than industry standards recommend. Here’s what that actually means for your passwords.

Let me tell you about the moment I stopped feeling smug about my password hygiene.

I had the setup. Long passwords, different for every site, stored in Firefox’s built-in manager. I’d even set up Firefox’s Primary Password feature — the optional master password that encrypts everything. I thought I was ahead of 95% of people.

Then I went down a rabbit hole on PBKDF2 iteration counts, and I haven’t felt the same about my browser since.

Here’s the thing about browser security: it’s almost never about whether encryption exists. It’s about how hard the encryption is to break once someone has the encrypted file. And that distinction matters enormously in a world where infostealer malware — software that silently exfiltrates browser databases — has become one of the most common attack vectors in 2025 and 2026.

What PBKDF2 actually does, in plain English

When you set a Primary Password in Firefox, the browser doesn’t just store your passwords under a lock. It runs a mathematical process called PBKDF2 — think of it as a deliberate computational workout — that converts your master password into an encryption key. The whole point of this workout is to make the process slow. Slow for you, yes, but also slow for any attacker who tries to guess your master password by brute force.

The number of times this process repeats is called the iteration count. And this number is the crux of everything.

Firefox runs this process 10,000 times.

The Open Web Application Security Project — the industry body that sets these standards — recommends a minimum of 600,000 iterations for 2026 hardware.

Firefox is running at 1/60th of the recommended strength. Not slightly behind. Not almost there. Sixty times weaker.

What that gap looks like when someone is trying to break in

I want to resist the urge to just throw a stat at you and move on, because the stat is genuinely hard to parse without context. So let me frame it this way.

Modern GPU-based password cracking tools — the kind that run on hardware you can buy at Best Buy — can perform hundreds of thousands of PBKDF2 calculations per second at Firefox’s iteration count. When an attacker gets hold of Firefox’s key4.db and logins.json files (which infostealer malware is specifically designed to grab), they can run this cracking process offline. No account lockouts. No rate limiting. Just uninterrupted computation until they find your master password.

For a typical 12-character password stored in Firefox’s Primary Password system, security researchers have clocked crack times in the days range using consumer hardware. Dictionary-based passwords — your dog’s name with some numbers at the end — fall much faster.

At 600,000 iterations, the same attack would take years. Sometimes decades. The encryption doesn’t get “stronger” in some abstract sense; it just takes so long to crack that it becomes economically worthless to try.

That’s the whole game. Not unbreakable — just expensive enough that no one bothers.

And Firefox’s current defaults don’t clear that bar for reasonably complex passwords against modern hardware.

The thing that genuinely surprised me

I knew Firefox’s iteration count was low. What I didn’t know — what I think a lot of people don’t know — is that the Primary Password feature is entirely optional. And when it’s not set, Firefox’s stored passwords have essentially no meaningful encryption at all.

Without Primary Password enabled, credentials sit in logins.json protected only by file system permissions. Any malware running at normal user privilege level can read that file. There’s no cracking involved. It’s just there.

Chrome, by comparison, wraps stored passwords in the operating system’s encryption infrastructure automatically — Windows DPAPI, macOS Keychain, whatever is native to your platform. You don’t have to know this is happening. It’s just what Chrome does by default.

In July 2024, Google went further with App-Bound Encryption: a system that ties decryption to the Chrome executable itself, so that other applications running on the same machine — even ones with the same user privileges — can’t access the passwords. Stolen database files become largely useless without access to the original machine and user session.

This is a fundamentally different security model. Firefox requires you to opt into decent encryption and then still delivers below-standard iteration counts. Chrome builds decent encryption into the default experience.

Why Mozilla hasn’t fixed this

This is where I’ll be honest about the limits of my perspective.

Mozilla has historically argued that the 10,000-iteration limit balances security with performance on older devices. There are Firefox users running on hardware that would noticeably slow down at 600,000 iterations. There are also accessibility considerations, backward compatibility concerns, and the organizational realities of a nonprofit browser team that doesn’t have Google’s engineering resources.

I understand all of that, and I don’t think it makes Firefox a bad browser. Firefox is genuinely better than Chrome on several dimensions that matter to me — privacy defaults, transparency about what the browser is actually doing, not being a product of an advertising company.

But security isn’t a dimension where “good reasoning behind a weaker default” is really a meaningful consolation. Your credentials either resist offline cracking or they don’t. And right now, for most Firefox users — the ones who’ve never heard of Primary Password, let alone enabled it with a strong passphrase — they don’t.

What I actually changed

I’m not here to tell you to switch browsers. That’s a decision with more dimensions than just this one issue.

What I did: I switched to Chrome for accounts where credential compromise would be catastrophic — banking, email, work tools. I kept Firefox for research and privacy-sensitive browsing where I don’t store passwords at all. I also moved most of my sensitive logins into a dedicated password manager (Bitwarden, for what it’s worth) that uses 600,000 PBKDF2 iterations by default and isn’t tied to any browser’s quirks.

If you’re staying on Firefox: enable Primary Password. Choose a passphrase — four or five random words strung together — not a password. Know that you’re still running below OWASP standards, and treat that as a real, if manageable, risk.

And if you’re on any browser: where a site offers passkey authentication, use it. Passkeys don’t store a password anywhere that can be exfiltrated. They’re not a browser problem, because there’s nothing to steal.

The assumption that your browser is automatically protecting your passwords is one of those comfortable beliefs that doesn’t hold up well to scrutiny. Firefox is trusted by hundreds of millions of people. A lot of them are running on a security configuration that a GPU array can chew through in an afternoon.

That’s worth knowing about. Even if what you do with the information is just to finally set up that Primary Password you’ve been meaning to get to.

Originally published on TechEd Publishers blog. For more articles like this, visit https://techedpublishers.com/.