I went looking for one thing in Credential Manager and found something else. Writing about how Windows 11 may be encrypting your drive already got me curious about what else the system stores without asking, so I opened the credential vault expecting a few stale network logins. Instead, close to eighty entries were sitting there, and most of them were not passwords.
Credential Manager is not the password list you think it is
Windows has kept a credential vault for years, and it still lives in the old Control Panel. You can reach it through Control Panel > User Accounts > Credential Manager, or skip the clicking and press control /name Microsoft.CredentialManager and press Enter. There is no equivalent page in Settings, which is part of why so few people ever look at it.
The landing screen splits into two areas. Web Credentials holds website sign-ins that were saved by older components such as Internet Explorer and legacy Microsoft Edge profiles, plus a few Windows and app tokens. On many systems, this list is small or empty.
Current Chromium-based Edge and other browsers keep their passwords in their own profiles, so that tab is usually thin. Mine had ten entries, mostly Google account tokens and a couple of Microsoft Store keys.
Windows Credentials is where things get interesting, and it splits again into three categories. Windows Credentials proper stores network logins, which is what fills up when you check "Remember my credentials" while connecting to a mapped drive. Certificate-Based Credentials covers smart cards. Generic Credentials is the catch-all that applications write to directly.
Best Deals: Dell Optiplex 3060 Desktop Computer
Prices last scanned 17 hours and 25 minutes ago
7 days ago: $356.99 USD
7 days ago: $356.99 USD
7 days ago: $519.99 CAD
Both of the first two categories were empty when I opened mine, so I added a few network shares and Remote Desktop connections myself to see where each type lands. Everything I had accumulated over the years sat under Generic Credentials, which tells you plenty about how this vault gets used in practice.
Remote Desktop deserves a note while we're here. The "Allow me to save credentials" box in the Remote Desktop Connection window stores your login as a Domain Password type, and Credential Guard refuses to use it. Saving the same connection with cmdkey /generic:TERMSRV/hostname produces a generic credential that works.
Our Latest TweakTown Guides
- The Complete Windows 11 Tweaking Guide for 2026: What to Change and What to Avoid
- Using Multiple Monitors? Change these Windows settings for a Better Experience
- Windows Sandbox is The Windows Security Feature Most People Never Use
- I ditched the Windows 11 context menu for this open-source tool, and here's why
- Windows 11 may be encrypting your drive already, and I checked where my recovery key went
Now for the part that matters most. This vault does not hold your browser passwords, your Wi-Fi keys, your Microsoft account password, or your Hello PIN. Passkeys have their own home at Settings > Accounts > Passkeys.
Frequently Asked Questions
Open a question for an answer from TweakTown's coverage of this guide, or ask your own below.
How can you tell which Credential Manager entries are safe to remove and which ones Windows or Microsoft apps will recreate?
How do you back up and restore the Windows Credentials vault before deleting entries?
Why can cmdkey /list not show Web Credentials, and when should you use vaultcmd instead?
Why do Remote Desktop credentials saved through the GUI differ from ones added with cmdkey /generic:TERMSRV/hostname?
Have a question that isn't listed here? Ask below, and TweakBot will answer it.
What Credential Manager holds is the set of credentials Windows itself saved on your behalf, which is a much narrower thing than people assume when they open it.
Back up the vault before you delete any entry
I'm not going to pretend removing a credential is dangerous, because it isn't. The worst outcome is that an app prompts you for a password the next time it needs one. Even so, twenty seconds of insurance beats reconstructing a list you can no longer see, so I backed the whole thing up first.
The option sits on the Windows Credentials tab. Click Back up Credentials, use Browse to pick a location, name the file, and click Next. Windows then asks you to press
Set a password on the backup, click Next, and you get a .crd file you can restore on the same PC or move to another one. Restore Credentials sits right beside it and reverses the process.
One limitation to note is that the backup covers only the Windows Credentials tab. Web Credentials has no export path at all, so anything on that side is on its own.
With the backup done, I stopped clicking. Expanding seventy entries one at a time in a Control Panel window from 2009 is not a good use of an evening.
Running cmdkey /list in Terminal dumps the whole Windows Credentials side as plain text, and cmdkey /list > creds.txt saves it to a file so you have a record of what the vault looked like before you touched it.
However, cmdkey has a blind spot. It cannot see Web Credentials. The tool that covers both is also built in: vaultcmd /list shows you the vaults themselves, vaultcmd /listcreds:"Windows Credentials" /all dumps one side, and vaultcmd /listcreds:"Web Credentials" dumps the other.
Most of my entries belonged to a password manager
Here is what the audit turned up. Of roughly seventy-eight entries across both stores, about fifty-six carried a NordPass/ prefix. Not passwords, just settings.
I mean that literally. There were entries named AppTheme, SidebarState, StartHidden, WindowState, SubscriptionData, and Upsell. There was one called HasNeverLoggedIn. Fifteen consecutive entries ran from split_Features0 through split_Features14.
A password manager had decided to use the Windows credential vault as a configuration store, and every one of those entries was stamped 4/8/2025, which is roughly when I stopped opening the app.
Given that I hadn't launched NordPass in months, all fifty-six went. Four more joined them: SEC_IV, SEC_KEY, and UTS, which were undated leftovers from software I no longer run, plus a JianyingPro Cached Credential from a video editor I tried once in early 2025. INSTALLATION_GUID went too. That brought me from seventy-eight entries down to seventeen.
Removing them is straightforward. Expand an entry in Credential Manager and click Remove, or run cmdkey /delete:targetname for a faster pass. Be aware that entries regenerate if the app that created them is still installed and still runs, so uninstall first if you want the cleanup to hold.
What stayed is the more useful list. SSO_POP_Device, SSO_POP_User, virtualapp/didlogical, and the MicrosoftAccount and WindowsLive token entries are all generated during Microsoft account setup, and they support Outlook, OneDrive, and Store sign-ins. They also recreate themselves within minutes if you delete them, so there is nothing to gain. OneDrive Cached Credential and Olk/PushNotificationsKey belong to apps I use every day. Anything certificate-based or tied to a work account stays as well.
The rule I settled on is simple enough. If the entry names an app you still run, leave it alone. If it names one you uninstalled two years ago, it has been sitting there ever since for no reason at all.
The vault refills, so put it on a schedule
For my usage, around twenty entries is a reasonable steady state. Seventy-eight was residue. This list tends to grow over time, and Windows won't notify you when it does, so an occasional audit is a good idea. While you're in Settings, you can have a look at Accounts > Passkeys, and the connected apps list on your Microsoft account page is worth checking too.
