They may end up in the registry, within credential files, or within the Windows Vault
These usernames and passwords may end up in the registry, within credential files, or within the Windows Vault. The credentials are stored in encrypted format, but can easily be decrypted using your Windows password. In this article, I’m going to show several tools you can use to view these hidden passwords on your system.
Windows Credential Manager
To get started, let’s talk about the built-in tool called Credential Manager that is in Windows. Click on Start and type in credential manager to open the program.
You’ll notice there are two categories: Web Credentials and Windows Credentials. The web credentials will have any passwords from sites that you saved while browsing in Internet Explorer or Microsoft Edge. Click on the down arrow and then click on the Show link.
So that’s something you should know when you login to an account while using another person’s computer, even if they are someone you trust. You may not want them to know your login credentials.
If you click on Windows Credentials, you’ll probably see fewer credentials stored here unless you work in a corporate environment. These are credentials when connecting to network shares, different computers on the network, or network devices such as a NAS.
In the same vein, I’ll also mention how you can view Google Chrome saved passwords. Basically, each browser has the same feature, so you can do the same thing for Firefox, Safari, etc. In Chrome, click on the three dots at the top right and then click on Settings. Scroll down and then click on Show advanced settings.
Under Passwords and forms, click on the Manage saved passwords link next to Offer to save your web passwords.
Here you’ll see a list of all the passwords that you have stored in Chrome. The list may be quite long if you have the save password feature enabled.
Third-Party Utilities
Even though you can find quite a few passwords using the methods above, there are still more saved in other locations on your system. To get to these, you have to use some third party tools. My favorite site for free and clean tools is Nirsoft. There are basically three tools you can use: EncryptedRegView, CredentialsFileView, and VaultPasswordView.
All of these tools can be downloaded, extracted and run without needing to install them. This is great because it doesn’t mess with your system at all and once you are done, you can just delete the files.
EncryptedRegView
When you run the program, you’ll see a dialog box where the Run as administrator box is checked. You don’t have to do anything, just click on OK. The program will then scan the registry and decrypt any passwords it finds in the registry.
Just arrow through the list and you’ll probably find a handful of gems. In my case, I found two passwords that were useful. Everything else was encrypted text that wasn’t a password.
CredentialsFileView
Instead of double-clicking on this program, you should right-click and choose Run as Administrator.
On the main dialog that pops up, you’ll need to type in your Windows password at the bottom before clicking OK.
Now you should see a list of various credentials stored on your system. If you’re on a domain, you’ll see a lot more entries.
VaultPasswordView
This one works the same way as CredentialsFileView, but instead looks inside the Windows Vault. This tool is especially useful for Windows 8 and Windows 10 users because these two operating systems store the passwords for Windows Mail, Edge, and IE in the Windows Vault.
If you thought those were the only useful password recovery tools from Nirsoft, you’d be wrong. Make sure to check out their entire page on password recovery tools. If you have ever forgotten a password that you have used before, these tools will help you recover them. Enjoy!
SiteLock is a service that is sold by a lot of popular hosts. A lot of them have licensing deals with SiteLock. 
Your website is scanned once a day automatically. Think of it as an anti-virus service for your web server. SiteLock uses something called “SiteLock911 scans.” What this does is scan all your files on your server to see if there is any malware injected into them. If any files are corrupted SiteLock will download them and reupload your data. It sounds like a simple process for safeguarding your data, but as you will see it isn’t that black and white.
Hi Garen
I have never heard of SiteLock and I did not know that having your website scanned was a thing. I mean, I thought that the hosting platform would perform such a task. Am I wrong? After reading your review, I have to agree that SiteLock is not necessary. It seems like they hook you with a free membership but then “pretend” that you actually need to pay more to have additional or full on scans of your site. And that is misrepresentation if they originally say that it was free.
Most host will do a scan on your website for free. For instance I have asked InMotion to run a scan on my server a couple times before. They ran a scan and didn’t charge me anything. I really think SiteLock is a waste of money!
The biggest thing here I’ve noticed in these reviews on Sitelock is the lack of education. Sitelock doesn’t appear to be a scam. It’s the misinterpretation of services offered and the technical understanding of website security as a whole by many uneducated website owners/consumers. Don’t blame the company because of what your host support or sales rep is saying about it. They are not specialists in the company product or the technical aspects of what it entails and the web application firewall is always a good thing to have on any website that exists.
Agree. Today hosting companies concentrate on selling you something and often don’t even understand what they sell.
Sitelock is a good software.
don’t get suckered people , you sign a total one sided contract that only benefits them , you are stuck for a year to pay them way to much money for a service where there are better and cheaper alternatives then signing with this company . 50% of an annual fee as cancellation , that is what you call a true scam.
Their sales people are very pushy and will trick you into paying for their services for entire year. I got a notice from my dashboard that my website had some vulnerabilities and SiteLock said it was urgent. Otherwise, my websites seal would no longer be in good standing. The price for fixing the problem was in the hundreds. I actually checked my website with https://sucuri.net/ and found out that there wasn’t really anything wrong with the website.
I requested a refund and SiteLock would not honor it. This company extorts people into getting more money from you. There should seriously be something done about this. They are charging people a monthly fee for protection. Then, they will tell you something is wrong when in actuality there isn’t anything wrong. Don’t let them trick you out of your money.
Thanks for your input. Sorry, you had to deal with SiteLock.
Unfortunately, I was conned by SiteLock. I use BlueHost and one day they contacted me because they suspended my account. There was a malware injection which they discovered. I panicked at the time and didn’t know what to do. I spoke with a SiteLock agent. He was very smooth talking and eventually signed me up for a $14.99 a month plan.
About 4 months after SiteLock I got a message in my Google Webmaster Tools. This told me my website had been hacked. I contacted SiteLock. They were unaware of the problem at first. Later they told me there was malware on the site. They requested that I pay them $249 to resolve the malware.
I couldn’t believe this. Why am I paying $14.99 for a service that is supposed to protect my website. Then it gets hacked and these these people want $249 to fix it! I canceled my account with SiteLock and hired someone on Upwork to fix my site for $15.
I feel cheated by SiteLock. Learn from my mistake and avoid them if they ever approach you. There are hundreds of stories like mine that I have read online. This is horrible!
Hey Ryan,
Thanks for stopping by and sharing your experience with us. $249 to clean up the malware and still charge you $14.99 a month for something that is supposed to protect you doesn’t seem like a worthwhile expense.
Hey, I’m currently going through the same problem that you did a couple years ago. I’m getting smooth talked by a Sitelock rep too.
What was your experience with the person you used from Upwork? Can you recommend that person? I’m interested in taking this route!
Thanks!
I am very troubled that now that HostGator has a strategic partnership with SiteLock, I have seen a dramatic uptick in security and malware issues on my hostgator servers. After years of only having an issue of perhaps one per year, I am now dealing with new reports of malware on a weekly basis and more. Imagine how much money that would be if you could set a script on a server (and lets face it, this would be a piece of cake for HG) that would set off malware and antivirus detectors? Then you sell your clients marketing details to SiteLock and let them sell you a $100 or $500 / year fix PER DOMAIN!! You could be talking many many millions of dollars. Scary stuff.
I agree it’s really kind of an unethical business plan in my opinion. Charging people for protection and then once that fails charging $100+ doesn’t seem right to me.
Similarly BlueHost as well