After a browser update, my saved passwords disappeared, although my bookmarks and browsing history are still present. I checked the password manager settings and confirmed I’m using the same browser profile, then restarted the browser, but the list remains empty. Should I look for a local profile backup, or could syncing overwrite recoverable data?
Which browser and operating system are you using, and was password sync enabled before the update? The recovery path depends heavily on that. Bookmarks and history surviving does not prove the password database is still attached to the active profile.
Before signing out, resetting sync, reinstalling, or creating another profile, close the browser and make a full copy of its current profile folder. If your system has Time Machine, File History, Previous Versions, or another backup tool, look for a profile copy from before the update. Restore it to a separate location first rather than replacing the live profile. Browser passwords are usually encrypted against the profile or operating-system account, so recovering only the password database file may not be enough.
I would pause sync while investigating. Sync may bring the passwords back if the server still has them, but repeatedly enabling, disabling, or resetting it can spread an empty or newer state across devices. If another computer or phone still shows the passwords, take it offline before opening the browser and export the passwords from that device if the browser allows it.
Check whether the update quietly created a second profile too. Profile names can look identical in the browser interface while pointing to different folders. If recovery works, export the passwords immediately and import them into a separate free password manager such as Bitwarden, then keep an encrypted backup. Do not start manually rebuilding the list until you have preserved the profile folder and checked every previously synced device.
22 Likes
Bookmarks and history cannot rebuild the missing passwords. If profile, backups, sync, and other devices turn up nothing, reset each account through the site, starting with your email account since it controls most password resets.
Before resetting everything, check whether the update created an extra profile or a “Default/Old” profile folder. If you recover the passwords, exporting them into Bitwarden can keep a future browser update from taking the only copy with it.
Do not start resetting accounts until you confirm this is actual data loss rather than an encryption or unlock failure.
Browser passwords often depend on the operating system’s credential store, such as Windows credentials, macOS Keychain, or a Linux keyring. You can be in the correct browser profile and still see an empty password list if the browser cannot unlock that store. Check that you are logged into the same operating-system account as before the update. Watch for a keychain prompt, credential error, or locked keyring. Do not delete or recreate the operating-system credential store while testing, since that could make recovery harder.
Open the browser’s full password-manager page and search for a specific site rather than testing only the autofill box. These are different failures. If entries appear there but not on login pages, the update may have disabled autofill, changed a permission, or disabled a password-manager extension. If the manager reports zero saved entries, that points more toward a profile, sync, or decryption problem.
I agree with @dragon.react that account resets become the practical answer when every recovery source is exhausted, but I would not do them all in one session. Keep any devices and browser tabs that are already logged in. Before changing a password, verify the recovery email, phone number, authenticator app, and backup codes for that account. Resetting the email account first makes sense only if you are certain you can complete its recovery without losing your current session.
If rebuilding becomes necessary, work outward from email to financial accounts, cloud storage, shopping, and lower-priority sites. Record each new password immediately in whichever manager you choose. Be careful with passkeys and two-factor recovery codes too, since restoring passwords alone may not restore those. Most importantly, avoid clearing browser data, reinstalling the browser, or removing system credentials until you have ruled out an unlock issue.
Realistically, recovery is binary: either another usable copy of the password vault exists, or the passwords have to be replaced. I would set a time limit on troubleshooting rather than spending days trying random profile repairs. Once you have preserved the current profile, checked backups, sync, other devices, the operating-system credential store, and any alternate profile folders, repeated reinstalling or toggling settings is more likely to destroy clues than reveal anything.
I disagree slightly with @dragon.react on the value of bookmarks and history. They cannot recreate a password, but they can help reconstruct the list of accounts you need to recover. Browser history, existing cookies, email receipts, registration messages, and searches for phrases such as “verify your email,” “new account,” or “security alert” can expose forgotten accounts. That matters because most people remember their bank and main email but overlook utilities, subscription services, old shopping accounts, and sites holding payment details.
If rebuilding is necessary, make a simple checklist before changing anything. Start with the email account that receives reset messages, but only after confirming you still control its recovery phone, backup email, authenticator, and any logged-in session. Then handle financial services, cloud storage, mobile carrier accounts, shopping sites, and everything else. Use each site’s official password-reset page rather than guessing old passwords until the account locks. Save every replacement password immediately, and record whether the account uses two-factor authentication or a passkey.
Keep checking the supposedly empty password manager during this process. If entries suddenly return after the browser or system credential store signs in correctly, stop resetting accounts and export the recovered vault. If nothing returns, the history-based checklist gives you a controlled rebuild instead of the usual cycle of discovering another missing login months later.
Check the file dates in your profile folder before you do anything else. If the password database file still exists and its modified date is from before the update, the data is probably fine and something just can’t read it. If that file is gone or freshly zeroed, that tells you a different story. This one detail rules out half the guesses in this thread in about thirty seconds.
@beacon.dev already nailed the real culprit for most of these cases, so I won’t repeat it. The credential store not unlocking is way more common than actual deletion. What I’ll add is a specific trap on Windows: passwords in Chromium browsers are tied to your Windows login through DPAPI. If your Windows account password got reset, or you somehow ended up on a different Windows user, the entries are still sitting there but the browser physically cannot decrypt them. Same profile, same everything, and you still see an empty list. Fixing the Windows account side sometimes brings them straight back with zero recovery effort.
Where I’d push back a little is on the whole recover-then-rebuild framing. People jump between those two like there’s nothing in between. There often is. An empty list plus intact bookmarks and history usually means the profile is intact and the block is on encryption or sync, not that the vault got wiped. So treat ‘empty’ as suspicious, not final.
On the Bitwarden suggestion, sure, exporting to something independent after you recover is sensible, but that’s a next-update problem, not a right-now fix. It does nothing for the passwords already missing today. Sort out the read failure first, then worry about where the backup lives.
If you genuinely confirm the file is gone and no backup or synced device has it, then yeah, @devpilot is right to put a clock on it. Don’t burn a weekend reinstalling and toggling settings hoping it magically returns. At that point history and receipts are your account list and you start resetting, email first, but only once you’ve verified you can actually get back into that email.
Don’t start account resets until you check which sync account the password manager is actually using. The browser profile name and the signed-in sync email are separate things, which is easy to miss after an update.
If you have more than one Google, Microsoft, or Mozilla account, switch through them in the password manager itself. An update can leave bookmarks local while showing an empty password vault from the wrong account.