Greasemonkey Storage

Is there any limit on how much data can be stored using GM_setValue?

Where are Greasemonkey scripts stored?

They're stored in an IndexedDB ( https://github.com/greasemonkey/greasemonkey/blob/master/src/bg/user-script-registry.js#L287 ) which is a format with very little (AFAIK?) tooling. (Because there's very few options for persistence for a WebExtension.)

Is Tampermonkey or Greasemonkey better?

Tampermonkey is more recent than Greasemonkey and supports all the major browsers. Furthermore, Tampermonkey is fairly easy to use for both beginners and advanced users. It's easier to install scripts on Greasemonkey but Tampermonkey's features like code checking help you be more accurate.

Can Tampermonkey scripts steal passwords?

Yes, userscripts can steal your passwords. That's the bottom line.

GM stores it in properties. Open about:config and look for them.

According to http://diveintogreasemonkey.org/api/gm_getvalue.html, you can find them in the greasemonkey.scriptvals branch.

This sqlite info on its limits shows some default limits for strings and blobs, but they may be changed by Firefox.