I have looked around and found no information on how Android manages to store passwords on the device. Especially Gmail passwords. I'm looking to learn how Android encrypts and stores passwords ? What key does it use and where is this key stored, and what encryption algorithm it uses.
Gmail's official app doesn't store password in your device. Your password is 100% safe if you use this app.
This is how it works: The password is used by Google's authentication servers for the first time ONLY. After first successful authentication, an
Note: These all aren't true if you use third-party email apps for Gmail viz. Stock Email app, K-9 Mail etc. IMAP or POP protocol needs original password to authenticate users everytime. So, plain password needs to be available to email app before sending it to server. So, most of email apps store passwords in plain text (hashing/encryption is useless because hashing/encryption key needs to be stored locally). In this case, I'd recommend you to enable
Android passwords used with the built-in Email application are stored in plain text inside a SQLite Database. This is in contrast to the Gmail application, which uses Auth Tokens as described in Sachin Sekhar's answer.
For Jelly Bean, the database location is:
The above location varies with the Android version
This location on a non-rooted device is secured and protected by the Operating System.
A member from the Android Development Team posted an explanation that till today still applies:
Aditionally, since this issue appears to disturb many Android users, you can also follow this discussion at Slashdot - Android Password Data Stored In Plain Text.