I think they are protected as long as you have not entered the Master Password during the current session.

If I try to access Options > Security > Saved Passwords, Firefox demands my Master Password. If I cancel that prompt, I get a blank dialog.

On disk, the logins.json file seems to have encrypted versions of BOTH the username and password. To view that file:

Open your current Firefox settings (AKA Firefox profile) folder using either

• "3-bar" menu button > "?" button > Troubleshooting Information
• (menu bar) Help > Troubleshooting Information
• type or paste about:support in the address bar and press Enter

In the first table on the page, click the "Show Folder" button. This should launch a new window listing various folders and files. You can scroll or search to find logins.json, which is a plain text file but which has a hard-to-read layout (no line breaks or extra spaces).

EDIT: Sorry, please ignore extraneous material I have deleted from this post!

Whoops, there was some extraneous material in that post related to the localstore.rdf file. PLEASE IGNORE THAT PART. Only follow the part that now appears at: https://support.mozilla.org/questions/1049640#answer-697473

(I will preview more carefully next time.)

It is best to open files in JSON format in the Scratchpad (Firefox/Tools > Web Developer) because that component has a "Pretty Print" button to format the file for readability.

• https://developer.mozilla.org/Tools/Scratchpad

When you enter the Master Password when prompted then you log in to the Software Security Device and it is possible to have access to the stored passwords until you log out of the Software Security Device. You can copy the name or password to the clipboard in the Password Manager window (Show Passwords) via the right-click context menu (you need to enter the MP) and you can paste it in log in fields.

You can log out from the Software Security Device (e.g. click Cancel in the Show Passwords dialog) to force re-entering the MP once again.

• Options > Security: Passwords: "Saved Passwords" > "Show Passwords"

You can view the current status via this page (either Log In button or Log Out button is enabled):

• Options > Advanced > Encryption: Certificates > Security Devices
  Select: Software Security Device: Log Out button

You can set the signon.autofillForms to false on the about:config page to prevent Firefox from filling autocomplete data automatically.

My logins.json file has encrypted usernames and passwords.

I can't tell whether we've successfully answered your original question or whether you are still not sure about the security of the master password system. All good?