Where Does Windows Store Local Secrets?
Windows guards local secrets in the SAM hive and DPAPI master keys, both locked to the machine and account.
Last updated
Windows keeps local account hashes in the SAM hive and per-user encryption keys in DPAPI master key files. Together they underpin saved passwords, certificates, and anything encrypted to your login.
Both live behind system locks: SAM in the config directory readable only offline or by SYSTEM, DPAPI keys in your Roaming profile tied to the password. Forensics images them cold; admins back up the keys. Touch neither casually, since corrupting either locks you out of everything it protects.
Where Windows stores this, by platform
C:\Windows\System32\config\SAM
Local account hashes. Locked while Windows runs; readable only offline or as SYSTEM. Back up before risky registry work.
%APPDATA%\Microsoft\Protect
Per-user master keys wrapping saved passwords and certificates. Tied to the account password; resets without the old password orphan the data.
Frequently asked questions
Why did a password reset break saved logins?
DPAPI keys wrap to the account password, so a password reset without the old one orphans encrypted data. Back up the keys or export certificates before resets.
Notice an outdated path? Let us know.