as others have said, it's encrypted if you enable the "master password" option; however, the ux of the master password is miserable: * the prompt for entering

as others have said, it's encrypted if you enable the "master password" option; however, the ux of the master password is miserable: * the prompt for entering your master password is a simple dialog, with "ok" and "cancel" buttons. a website could probably trigger an identical prompt with javascript to phish your master password. * the prompt pops up once when you first start the browser (about 15-30 seconds after everything is loaded) and then (if you dismiss it with "cancel") again each time you visit a site for which you have a saved password. there's no way to trigger the unlock prompt on-demand. * the master password doesn't have a timeout. once you've unlocked the keychain, it remains unlocked until you restart the browser. don't bother. stick with whatever third-party extension you're using.