I am trying to utilize the password manager feature in Brave because sometimes I can’t remember what my password is for certain sites. After I click on “Password Manager”, I get the listing of all my saved sign ins. I click on the one I am interested in accessing so I can see what my saved password is for that site, and I keep getting a box that tells me that Windows Security wants me to type my Windows password to allow this. How do I disconnect my Windows account so I don’t have to do this?
@SONman25 you can’t disable that if you want to use Brave’s password manager. Same for Chrome and most other browsers. They all use OSCrypt which relies on the OS keyring. For Windows, this is Windows DPAPI. Basically it uses your OS credentials to encrypt everything.
When you try to view a saved password, Brave has to decrypt it, and on Windows that decryption uses the Windows account credentials (DPAPI/OSCrypt).
Here is how it works at a high level.
• Brave saves your login data in its profile, but it is encrypted using Windows’ Data Protection API (DPAPI).
• The decryption key is tied to your Windows user account.
• When you try to view a password, Windows requires you to authenticate to prove you are that user.
• Only after Windows approves does Brave get temporary access to decrypt and show the password.
This design has important security benefits.
• If someone copies your Brave profile files to another computer, the passwords cannot be decrypted there.
• Malware running under a different Windows account cannot silently read your saved passwords.
• A person sitting at your unlocked PC cannot instantly reveal all passwords without knowing your Windows credentials.
If you really don’t want that Windows prompt, the alternatives are to stop viewing passwords through Brave’s password manager, or switch to an external password manager that uses its own master password or unlock method instead.