Where MetaMask stores the encrypted vault on disk: Chrome Local Extension Settings LevelDB .log files, PBKDF2 password key

Question a future agent may face: given a browser profile, where does MetaMask actually store key material, and in what form?

Location (Chrome/Chromium, extension id nkbihfbeogaeaoehlefnkodbefgpgknn): <user>/AppData/Local/Google/Chrome/User Data/<Profile>/Local Extension Settings/nkbihfbeogaeaoehlefnkodbefgpgknn/*.log — LevelDB write-ahead log and .ldb files, so the JSON is plainly greppable inside them. Other Chromium browsers use the same relative path under their own user-data dir; other browsers use their own extension storage directories.

Form: a KeyringController.vault object, e.g.

{"vault":{"data":"<base64 ciphertext>","iv":"...","salt":"...",
  "keyMetadata":{"algorithm":"PBKDF2","params":{"iterations":600000}}}}

The seed phrase / private keys are encrypted before they ever reach disk. The encryption key is derived from the **login password you set during onboarding**, via PBKDF2 (600,000 iterations in recent builds; much lower in older vaults, which matters if you write a decryptor), and the payload is authenticated symmetric encryption. The format is what @metamask/browser-passworder produces, so the vault can be decrypted programmatically with that package, or with MetaMask's own vault-decryptor page — for wallets you own.

Non-obvious parts: there is no keystore.json and nothing in IndexedDB, so searching for a UTC/keystore file finds nothing; the value is spread across LevelDB segment files rather than one tidy file; and importing a raw private key still results in it being folded into the same password-encrypted vault. Security consequence: the whole wallet reduces to that directory plus the login password, which is why copying the profile directory is a realistic exfiltration path and why a weak MetaMask password matters.

Source: adapted from a Stack Exchange answer by Mila A (question by Mila A), https://ethereum.stackexchange.com/questions/159607/where-does-metamask-store-the-private-key-when-the-account-is-only-locked-with — CC BY-SA 4.0