Q: What is a PWL file ?
A: Files with the .pwl extension (stands for PassWord List) contain saved passwords. The passwords are stored in an encrypted form, Windows logon password used as a key. If this password is unknown the access to the PWL file contents can only be obtained by means of a password search. If, while entering a password, you ask Windows to save it, Windows saves a password in a PWL file. PWL files can be found in Windows directory. Its name usually appears as USERNAME.PWL. All PWL files registered in system.ini file (this file is located in Windows directory).

Q: How to get passwords from PWL file ?
A: Windows encrypts contents of PWL file using user's logon password. If logon password is known (for example for current user who have entered password on startup) then all stored passwords may be extracted easily. But if logon password is lost you need first to find it.

Q: What about Windows versions ?
A: The original Windows 95 version contained a gross error which enabled easy deciphering of PWL files. In the OSR2 version this error has been corrected. Windows '98 does not seem to differ from OSR2 in the sense of security, but Windows NT is built quite differently. About Windows 3.x. I forgot about it :-). But probably its PWLs are same with original Windows 95.

Q: What is a PwlView (pwl_cra) program ?
A: PwlView is my program that was released in a hurry without any documentation (I thought it was kind of self-explanatory). As a result I was simply flooded with hundred questions on this program. PWLView has been distributed quite widely. It is available on different sites under different names. PwlView just shows cached passwords using standard (but undocumented) windows API on local machine for current user (user must be logged in) and no more.

Q: Why pwlview works instantly while pwltool takes a lot of time ?
A: PwlView shows passwords for current user when user logged in. When logon password is known all stored passwords may be extracted easily (see above).

Q: My question is not listed here...
A: Ask me via email