If you have autofill then it's just in a list in the browser. Encrypted usually behind your windows credentials. It can be viewed in the browser settings with a simple couple of clicks.
The cookie does not have the password. It takes the place of it temporarily and yes often includes some crytpographically secured data only the server knows as "proof". It's not the password in any way though.
Cookies don't contain anything that could recreate a password.
Where is the autofill stored then? Must be on the local PC somewhere right?
If you have autofill then it's just in a list in the browser. Encrypted usually behind your windows credentials. It can be viewed in the browser settings with a simple couple of clicks.
And if I stay logged in, that's cookies right? But I guess that just uses some public/private key hashes then, and they probably changed?
Servers generate auth tokens from which passwords cannot be extracted. One popular approach is JWT.
The cookie does not have the password. It takes the place of it temporarily and yes often includes some crytpographically secured data only the server knows as "proof". It's not the password in any way though.