
For more information on the gritty details, visit the official blog post.

This raises some concerns, because if Mozilla can access your Firefox Sync account – technically, so can hackers. That key is stored online by Mozilla, and can be employed by users to reset their username and/or password. Now, despite Firefox Sync passwords being encrypted locally with end-to-end encryption, a key is generated from the username and password. This was done to provide a better user experience, as their past system didn’t allow users to recover or reset lost/forgotten passwords. However, in 2014 they officially switched to a more traditional cloud-based syncing solution. In the past, Firefox Sync used a pretty beefy system to secure your data. Unfortunately, Firefox Sync is another story. Provided you create a complex master password in addition to using the service, Firefox Password Manager should store your data securely using a 256-bit AES cipher. What's more, Firefox can only store web-based passwords, which means you won’t be able to use the password manager with non-web-based programs/information. For example, Firefox can’t generate strong passwords for you.

Currently, Firefox is the only browser that offers you the ability to encrypt all of your passwords with one master password.
