Windows 95 Screen Saver Password Validation

Windows 95 handled screen saver password validation by offloading the authentication process from individual screen saver applications to a centralized operating system component. When a user attempted to dismiss an active screen saver, the screen saver framework invoked a dedicated function inside PASSWORD.CPL, checked the input against the encrypted password list file (.PWL), and determined whether to terminate the process or resume the visual display. Because Windows 95 lacked the secure desktop architecture of Windows NT, this entire mechanism operated within standard user space, making it functional for casual privacy but vulnerable to low-level bypasses.

The Role of SCRNSAVE.LIB and Process Invocation

In Windows 95, screen savers were standard 32-bit (or 16-bit) executable files using the .scr file extension instead of .exe. Microsoft provided developers with a static runtime library called SCRNSAVE.LIB. When a screen saver executed in full-screen mode (invoked automatically by the system or via the /s command-line switch), SCRNSAVE.LIB handled standard message processing, cursor hiding, and hardware event monitoring.

When the system detected mouse movement, a mouse click, or a keystroke, the standard window procedure inside SCRNSAVE.LIB intercepted the message before allowing the application to close.

Triggering the Password Check

Before terminating, the screen saver queried the Windows Registry to determine if password protection was active. It looked for the string value ScreenSaveUsePassword under the key:

HKEY_CURRENT_USER\Control Panel\Desktop

If this value was set to 1, the runtime library did not immediately destroy the screen saver window. Instead, it dynamically loaded PASSWORD.CPL (the Control Panel applet responsible for password management) using LoadLibrary and retrieved the address for the undocumented export:

VerifyScreenSavePwd(HWND hwndOwner)

Validation via PASSWORD.CPL and the PWL File

Once called, VerifyScreenSavePwd took control of the input focus and displayed the modal "Enter Screen Saver Password" dialog box over the screen saver's window canvas.

Windows 95 did not use a centralized security subsystem like Windows NT's Local Security Authority Subsystem Service (LSASS). Instead, it validated the entered string against the credentials stored in the user's password cache file (<username>.PWL), located in the C:\WINDOWS directory:

  1. Input Hashing: The system parsed the text entered into the dialog box and hashed it using the internal Windows 95 password-hashing algorithm.
  2. Cache Comparison: It compared the hash against the password entry for the currently logged-in user inside the .PWL file.
  3. Return Value:
    • If the input matched, VerifyScreenSavePwd returned a non-zero value (TRUE). SCRNSAVE.LIB then called DestroyWindow, restored the mouse cursor, and returned the user to the active desktop session.
    • If the input was incorrect or the user clicked "Cancel," the function returned zero (FALSE). The screen saver hid the dialog box, re-captured the mouse and keyboard input focus, and continued running without terminating.

Architectural Limitations

Because Windows 95 was built on a hybrid 16-bit/32-bit architecture without hardware-enforced memory isolation between user applications, this validation flow lacked true administrative security:

  • Single Desktop Environment: The screen saver and its authentication dialog ran on the same interactive desktop as all running user applications, unlike Windows NT, which ran screen savers on a separate desktop and validated credentials through Winlogon.
  • Process Termination: Any background program or automated macro could locate the screen saver's top-level window handle (HWND) using FindWindow and send a WM_CLOSE or WM_DESTROY message directly to it, bypassing the VerifyScreenSavePwd routine entirely.
  • Direct Process Termination via Task Manager: Users could occasionally trigger the "Close Program" dialog via keyboard interrupts (Ctrl+Alt+Del), select the running .scr file, and terminate it without ever satisfying the password check.