Firefox Password Manager: Stronger Security With New Encryption

Firefox’s password manager now uses server-side cloud synchronization protected by AES-256-GCM, with data in the cloud encrypted by Mozilla Foundation, according to Mozilla Foundation. For local use, data must still be transmitted to the device for decryption, which can occur only after the user enters their master password for verification.

The article notes that the older local data protection used 3DES-CBC and that, beginning with Firefox version 144.0, this has been replaced with AES-256-CBC, offering stronger security and greater efficiency. Mozilla clarified that logins stored in the Firefox Password Manager are now encrypted using a more modern scheme, switching from 3DES-CBC to AES-256-CBC, and that this change affects only the local encryption on disk, while logins synced through Firefox Sync remain end-to-end encrypted with AES-256-GCM.

The piece emphasises that brute-forcing AES-256-GCM is virtually infeasible given the current state of cryptanalysis, contributing to a high level of overall security. Published on 17 September 2025.