We reviewed FireMaster back in 2007. The principle to recover the Firefox master password has remained the same but the options to recover it have been improved. FireMaster is compatible with the latest version of the Firefox web browser. It uses brute force, dictionary attacks or a hybrid of both methods to recover the Firefox master password.

The command line tool requires the key3.db file which stores the master password information. The tool uses the following method to recover the password.

• FireMaster generates passwords on the fly through various methods.
• Then it computes the hash of the password using known algorithm.
• Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
• Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.

The success rate of the available methods depends largely on the Firefox master password. One interesting feature is the ability to specify known parts of the password in the command line argument.

FireMaster.exe -b -c "abyz" -l 12 -p "fire?????123" c:\testpath

This command above will perform a brute force crack using the character set abyz. The minimum password length has been set to 12 in this example and the password begins with fire and ends with 123. The path at the end points to the key3.db file that contains the master password information.

Firemaster is compatible with all official versions of Firefox and runs on Windows operating systems.