mozdmp

mozdmp decrypts passwords saved in the Firefox browser by extracting keys from the NSS database.

Supports the latest versions of Firefox, which use different global salt sizes and hashing algorithms and are currently not supported by hashcat/JTR.
Multi-core cracking of the master password is supported using wordlists.

Featured on mesquidar/ForensicsTools

Hi everyone, I've built a tool for decryption of Firefox profile data and multi-core cracking of the master password and would appreciate any feedback or contributions you might have to offer.

The actual decryption process is explained in detail in the README if anyone is curious and would like to learn more about how it works.

Important features:

Supports the latest versions of Firefox, which use SHA384 to derive the PBKDF2 input. The correct hash type is automatically selected.
Multi-core cracking of the master password is supported using wordlists. (This is useful because hashcat and JTR cannot be used to crack the master password as they do not support the latest hash and global salt formats)

Demo

  ≻ ./mozdmp data/psw_1looove/key4.db data/psw_1looove/logins.json
  [*] Checking Master Password...
      >> Check Master Password == '' ... NO
  [*] Attempting to crack master password...
  [+] Multi-Core Enabled
  [?] Enter wordlist path: rockyou.txt
  [?] Workers (default 20):
  [*] Loading wordlist...

    W0:  2407/717220 [00:11<56:18, 211.60pwd/s]
    W15: 2325/717220 [00:11<56:54, 209.39pwd/s]
    W8:  2278/717220 [00:11<58:55, 202.20pwd/s]
    W3:  2608/717220 [00:11<51:47, 229.99pwd/s]
    ... (workers W0-W19)

  [+] FOUND MASTER KEY: 1looove

  [*] KDF Parameters:
  {
    "salt": "2a24f5f8ec2fc74eccd6fa396f11aa34f1c8d3de269af38ca1324539ec5a4894",
    "iterations": 10000,
    "keylen": 32
  }

  [*] AES Parameters:
  {
    "iv": "040ed33681631562b28ee4494725e9bc"
  }

  [*] Global salt: 733f22304895df339a778680cbda652191f0b46fd240f1340b81e79c4997dcac11b25b897bc779cdbad0eb6cbe1696e5
  [*] KDF input (SHA384(global_salt + password)): aa5bf320258a8f9c10dc1a23dc415e3143d258c36c3218018672f0df1a6b9edb3174198700bf463201e8017d7f42767e
  [+] Decrypted AES key: 462f7891ab8e708c1a93122a3b2857a5b016472b9d58cb40b52449db64e4a68a

  [*] Decrypting passwords from logins...

  Hostname:        https://auth.wikimedia.org
  Username:        joog
  Password:        boog
  Created At:      08 June 2026 11:40

Visit mozdmp - Firefox profile decryption tool and master password cracker.