Where on Xiaomi stored passwords from applications: hidden folders, system databases and leakage risks

Have you ever wondered where the saved passwords from the apps went after you reset your Xiaomi phone? Or why, after flashing, some services log in automatically and others don't? MIUI (Even in the latest versions of Android 14, it uses multiple layers of credentials, from open text files to encrypted system containers, and if you think all passwords are in one place, you're wrong.

In this article, we will not just list the standard paths like /data/system/users/0, We will also be able to find out how Xiaomi (including Redmi and the Redmi). POCO) It processes passwords from Google accounts, social media, banking apps, and even gaming customers, and you'll learn what data can be extracted without root rights, where hackers search for passwords when they steal a phone, and why even a factory reset doesn't always erase critical information. How to protect your data from leakage if you sell or transfer a smartphone.

1. How Xiaomi Classifies Passwords: 3 Types of Storage

Before you look for passwords, you need to understand that Xiaomi divides them into three categories – and each is stored in its own way:

• 🔑 System credentials – passwords from Mi-account, Google, Wi-Fi and VPN. They are tied to firmware and encrypted with hardware keys (Keymaster).
• 📱 Application passwords – logins / passwords from VKontakte, Telegram, Tinkoff, etc. Stored either in plain form (if the application does not use Android Keystore), or in encrypted databases.
• 🔐 Autocomplete and password managers – data from Google Smart Lock, Mi Browser or third-party managers like Google 1Password. It uses a separate encryption.

Key point: MIUI It doesn't store all passwords in one place, like an Instagram password saved through Google's autocomplete will be in one place, and the same password entered manually in the app will be in another place, and this is not a developer's whim, but a security measure: If an attacker gains access to one base, he can't pull out the rest.

But there's a downside: data fragmentation makes it harder to control, so if you delete an application, its password can stay in the autocomplete cache or backup of Mi Cloud, and when you transfer your phone to another person, those residues can become a vulnerability.

2. Standard ways of storing passwords (without root)

If you do not have a superuser (root) right, only data that:

1. Stored in open user folders.
2. Available through API Android (e.g. Google Smart Lock).
3. Saved in backups (local or Mi Cloud).

Here are the key locations that can be checked without special tools:

⚠️ Note: Even if you find files with passwords in folders /sdcard/, They can be encrypted. MIUI It's protected by a key attached to your Mi Account, and you can't recover it without it, because it's designed to prevent theft of information when you lose your phone.

The easiest way to view saved passwords is to use built-in tools:

1. Open the Settings. → Passwords and security → Passwords (on) MIUI 14).
2. If you use Google Smart Lock, check passwords.google.com in your browser.
3. For Mi Browser: Go to the menu → Settings → Confidentiality → Saved passwords.

💡

If you sell a phone, turn off password sync in your Mi Account and Google before reset, otherwise new owners can access your data through the cloud.

3. Where root access passwords are stored: system folders and databases

If you have root rights (or use custom recovery like this) TWRP), You can access system folders where Android and MIUI They store critical data:

• 📁 /data/data/com.android.providers.settings/databases/settings.db — Authorization tokens and some credentials may be stored here.
• 🔒 /data/system/users/0/ — folder with encrypted keys for Wi-Fi, VPN and other system services.
• 📱 /data/data/[package_name]/ — For each application (for example, com.vk.android for VKontakte) there is a folder with a database (databases/) and settings (shared_prefs/).
• 🗝️ /data/misc/keystore/ — Keymaster, where encrypted passwords from banking applications and payment systems lie.

⚠️ Note: Direct editing of files in /data/data/ It can lead to the collapse of applications or lock the account (for example, if you change the tokens of VKontakte or Telegram).In addition, many modern applications (especially banking) use White-Box Cryptography - even with root, it is almost impossible to decrypt their data without knowing the algorithm.

Example: To view Wi-Fi passwords, you need to:

1. Open the file /data/misc/wifi/WifiConfigStore.xml (Root Explorer is required or ADB).
2. Find a line <string name="ConfigKey">[SSID]</string>.
3. Copy the encrypted password in the PreSharedKey field.
4. Decrypt it with the help of the utility wpa_supplicant (I need a key from Keystore).

For most users, this process is too complicated — and that's a good thing. The harder it is to access passwords, the safer your data is. But hackers use automated scripts that go through known paths and try to extract information even without rooting (for example, through vulnerabilities in the Internet). MIUI).

Check the version. MIUI (Some ways are changing)

Create a backup copy /data/

Turn off the internet (to keep security triggers from going off)

Use only proven tools (Root Browser, SQL Editor)-->

4. How Xiaomi apps store their passwords: examples of popular services

Not all applications are equally secure, such as:

• 💰 Banking applications (SberBank, Tinkoff, Alpha-Click) – use Android Keystore + Passwords are not stored in plain form, but can remain in cache after release.
• 📧 Social networks (Vkontakte, Instagram, Telegram) – often save access tokens in the Internet shared_prefs, This is a long time (even if you change your password).
• 🎮 Gaming clients (Genshin Impact, Honkai: Star Rail) – can store data for autologins in the public domain JSON-file.
• 🌐 Browser (Mi Browser, Chrome, Firefox) – passwords are encrypted, but the keys are stored in the system (they can be extracted from root).

Consider the example of Telegram:

1. The Data Path: /data/data/org.telegram.messenger/.
2. File with settings: shared_prefs/org.telegram.messenger_config.xml.
3. It can be stored here: 🔑 lastKnownProxy – Proxy data. 📱 LastLocalKey – Local Encryption Key. 🔄 pushString – a token for push notifications (can be used to restore a session).

⚠️ Note: Even if you delete Telegram and re-install it, the app can automatically log into your account via a saved token, which is convenient but dangerous: if your phone is stolen, an attacker will gain access to your correspondence without entering a password.

Here is how things are with banking applications (on the example of Sberbank Online):

• 🔒 The password from the application is stored in the Android Keystore and is not extracted even from root.
• 📱 However, in /data/data/ru.sberbankmobile/ Can stay: Cache data on recent transactions, analytics logs (unless the sending of statistics is disabled), push notification tokens (they can be used for phishing).

Most banking applications tie the session to the unique characteristics of the device (IMEI, MAC-If you change your phone, you have to confirm your login via SMS or biometrics, which is a protection against cloning your account.

5.Leakage risks: Who and how could steal your Xiaomi passwords

Even if you don't share your phone with outsiders, your passwords could fall into the wrong hands.

• 📲 Theft/Loss of Phone – No PIN-The attacker will not gain access to the data, but may:
• 🔄 Transferring the phone to another user – even after resetting, the settings may remain:
• 🦠 Malware: Trojans like Anubis or Cerberus can be used to:

📌 The real case: In 2022 Researchers at Check Point have discovered a vulnerability in the MIUI, Retrieving passwords from Google and Xiaomi accounts ADB, Even if debugging is disabled, the problem affected Android devices. 10-12 and was corrected only in MIUI 13.0.4. If you have old firmware, the risk of data theft is higher.

How do you defend yourself?

1. Turn off Settings. → Additionally. → For developers → Debugging by USB.
2. Set a complex pattern lock (at least 8 points) or PIN (at least 6 digits).
3. Turn on the settings. → Passwords and security → Blocking applications for banking services.
4. Check your active sessions regularly on your Mi Account and Google.

6.How to completely delete passwords before selling a phone

Factory reset (Settings) → The phone. → Setting resets don't always erase all data. Here's what you need to do before you hand over your phone:

Untie the Mi Account (#6484## → Remove Account)

Delete your Google account (Settings) → Accounts)

Turn off password sync (Google Smart Lock and Mi Cloud)

Reset via Fastboot (if there is a root or bootloader unlocked)

Format internal memory after resetting-->

If you have a bootloader unlocked, the most reliable way is to reset via Fastboot:

fastboot erase userdata


fastboot erase cache




fastboot flash userdata userdata.img




fastboot reboot

This will completely re-write the section with user data, including:

• 📁 File residues in /data/.
• 🔑 Cash Android Keystore.
• 📱 Application settings (shared_prefs).

⚠️ Note: If you sell a phone with a locked bootloader, the new owner will not be able to unlock it during the period of time. 7-30 days (Xiaomi restriction) Clarify this in the ad to avoid claims.

For devices with MIUI 14 And there's another caveat: after a reset, the system can store encrypted copies of some data in the partition. /metadata. To remove them, you need to:

1. Go in. TWRP (if established).
2. Select Wipe → Format Data (this will delete everything, including internal memory!).
3. Reboot and set up the phone as new.

If you are not sure about your actions, it is better to take the phone to the Xiaomi service center and ask for a “complete cleaning” before selling. 500-1000 rupees, but will save you from the risks.

7. Alternative ways to manage passwords on Xiaomi

Instead of relying on MIUI's built-in password storage, consider these safer alternatives:

• 🔐 Third-party password managers:
• 📱 Hardware tokens:
• 🌐 Cloud solutions with zero knowledge:

📌 Why it’s better than built-in storage MIUI?

1. Data is encrypted before being sent to the cloud (unlike Mi Cloud, where encryption can be managed by Xiaomi servers).
2. Password managers allow you to revoke access to the device remotely (for example, if the phone is stolen).
3. Support for Multifactor Authentication (MFA) critical-service.

⚠️ Note: If you use Google Smart Lock, remember that passwords sync with your Google account.This is convenient, but means that you can use your Google Smart Lock:

• Google employees can technically access your data (at the request of law enforcement agencies).
• When a Google account is compromised, the attacker will receive all the saved passwords.
• Some apps (such as banking) block autocomplete from Smart Lock for security reasons.

💡

No way to store passwords is 100% secure, and the best strategy is to combine a local manager (like KeePass) + hardware key (YubiKey) + regular-rotation.

FAQ: Frequent questions about passwords on Xiaomi