Firefox history file locations
2026-05-19 · 2 min
Firefox profiles live in a randomly-named directory under Profiles/,
typically <random>.default-release for a fresh install. On Windows the
cache splits across Roaming and Local — a subtle thing that catches
people who copy only Roaming and wonder why the cache pivot turned up
nothing.
Profile root by OS
Windows
C:\Users\<user>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>
C:\Users\<user>\AppData\Local\Mozilla\Firefox\Profiles\<profile>\cache2
macOS
/Users/<user>/Library/Application Support/Firefox/Profiles/<profile>
/Users/<user>/Library/Caches/Firefox/Profiles/<profile>/cache2
Linux
/home/<user>/.mozilla/firefox/<profile>
/home/<user>/.cache/mozilla/firefox/<profile>/cache2
profiles.ini at the parent level maps each profile name to its
directory. Useful when a user has more than one profile and you need to
identify the default.
What each file holds
| File | Format | What's inside |
|---|---|---|
places.sqlite | SQLite | moz_places, moz_historyvisits, moz_bookmarks, moz_annos (downloads) |
cookies.sqlite | SQLite | moz_cookies (plain values) |
formhistory.sqlite | SQLite | moz_formhistory |
favicons.sqlite | SQLite | moz_icons, moz_pages_w_icons |
webappsstore.sqlite | SQLite | LocalStorage (origin → key → value) |
logins.json + key4.db | JSON + NSS | Saved credentials (encrypted with profile key) |
sessionstore.jsonlz4 | mozLz4 + JSON | Currently open tabs |
sessionstore-backups/recovery.jsonlz4 | mozLz4 + JSON | Most recent backup |
sessionstore-backups/previous.jsonlz4 | mozLz4 + JSON | Tabs from the last session |
prefs.js, user.js | Text | Configuration |
moz_annos is easy to overlook — it carries the download metadata Firefox
no longer stores in a separate downloads.sqlite. Filter on
anno_attribute_id joined against moz_anno_attributes for the actual
attribute name.
Timestamps and WAL
Firefox uses PRTime — microseconds since the Unix epoch — for most
columns. See browser timestamp formats
for the per-column exceptions in moz_cookies.
places.sqlite runs in WAL mode. Always pull places.sqlite-wal and
places.sqlite-shm together. The
WAL recovery post covers
checkpointing.
Acquisition notes
- The
.jsonlz4session files use Mozilla's LZ4 variant (mozLz40magic), not standard LZ4. Decompress with a parser that knows the header or withlz4json. key4.dbis required to decryptlogins.json. Without the user's master password (often blank), tools likefirefox_decryptrecover credentials offline.- Cache2 is a content-addressed cache. Each file's name is a SHA-1 of the URL; the metadata sits at the end of the file. Useful when you need to prove a page was rendered, not merely visited.