diff --git a/security/nss/lib/softoken/sftkdb.c b/security/nss/lib/softoken/sftkdb.c
index 61cb2ce8b9..b89dbbee1f 100644
--- a/security/nss/lib/softoken/sftkdb.c
+++ b/security/nss/lib/softoken/sftkdb.c
@@ -314,7 +314,7 @@ sftkdb_fixupTemplateOut(CK_ATTRIBUTE *template, CK_OBJECT_HANDLE objectID,
 
     if ((keyHandle == NULL) ||
         ((SFTK_GET_SDB(keyHandle)->sdb_flags & SDB_HAS_META) == 0) ||
-        (keyHandle->passwordKey.data == NULL)) {
+        (sftkdb_PWCached(keyHandle) != SECSuccess)) {
         checkSig = PR_FALSE;
     }
 
@@ -1460,10 +1460,14 @@ sftkdb_CloseDB(SFTKDBHandle *handle)
         }
         (*handle->db->sdb_Close)(handle->db);
     }
+    if (handle->passwordLock) {
+        PZ_Lock(handle->passwordLock);
+    }
     if (handle->passwordKey.data) {
         PORT_ZFree(handle->passwordKey.data, handle->passwordKey.len);
     }
     if (handle->passwordLock) {
+        PZ_Unlock(handle->passwordLock);
         SKIP_AFTER_FORK(PZ_DestroyLock(handle->passwordLock));
     }
     if (handle->updatePasswordKey) {
@@ -2483,7 +2487,7 @@ sftkdb_ResetKeyDB(SFTKDBHandle *handle)
 {
     CK_RV crv;
 
-    /* only rest the key db */
+    /* only reset the key db */
     if (handle->type != SFTK_KEYDB_TYPE) {
         return SECFailure;
     }
@@ -2492,6 +2496,12 @@ sftkdb_ResetKeyDB(SFTKDBHandle *handle)
         /* set error */
         return SECFailure;
     }
+    PZ_Lock(handle->passwordLock);
+    if (handle->passwordKey.data) {
+        SECITEM_ZfreeItem(&handle->passwordKey, PR_FALSE);
+        handle->passwordKey.data = NULL;
+    }
+    PZ_Unlock(handle->passwordLock);
     return SECSuccess;
 }
 
diff --git a/security/nss/lib/softoken/sftkpwd.c b/security/nss/lib/softoken/sftkpwd.c
index f2acf76647..53b5d212dc 100644
--- a/security/nss/lib/softoken/sftkpwd.c
+++ b/security/nss/lib/softoken/sftkpwd.c
@@ -998,7 +998,11 @@ done:
 SECStatus
 sftkdb_PWCached(SFTKDBHandle *keydb)
 {
-    return keydb->passwordKey.data ? SECSuccess : SECFailure;
+    SECStatus rv;
+    PZ_Lock(keydb->passwordLock);
+    rv = keydb->passwordKey.data ? SECSuccess : SECFailure;
+    PZ_Unlock(keydb->passwordLock);
+    return rv;
 }
 
 static CK_RV