HackBrowserData

Decrypt & Export Chrome Data

Decrypt and export Google Chrome passwords, cookies, history, bookmarks, and credit cards on Windows, macOS, and Linux — including Chrome 127+ App-Bound Encryption (v20) cookies.

HackBrowserData decrypts and exports data from Google Chrome on Windows, macOS, and Linux — passwords, cookies, history, bookmarks, downloads, credit cards, extensions, and storage — including Chrome’s modern App-Bound Encryption (the v20 scheme in Chrome 127+).

Warning

For authorized security research and DFIR only. Run it on systems and accounts you own or are explicitly permitted to assess — see About .

What you can extract

Chrome is a Chromium browser, so all nine categories are available: password, cookie, bookmark, history, download, creditcard, extension, localstorage, and sessionstorage. See the category matrix .

Commands

bash
# Everything Chrome has (default scope)
hack-browser-data dump --browser chrome

# Just Chrome cookies, as JSON
hack-browser-data dump --browser chrome --category cookie

# Exclude credential-bearing categories
hack-browser-data dump --browser chrome --category history,bookmark,download

chrome is the --browser key. Output is one file per non-empty category — see Output & Data Formats .

Where Chrome stores data

OSUser-data directory
Windows%LOCALAPPDATA%\Google\Chrome\User Data
macOS~/Library/Application Support/Google/Chrome
Linux~/.config/google-chrome

Decrypting on each OS

On macOS, HackBrowserData asks for the current login password to retrieve Chrome Safe Storage; Keychain-backed password decryption may fail on macOS 26.4 or later. On Linux, v10 needs no keyring, while v11 needs an accessible D-Bus Secret Service. On Windows, Chrome 127+ protects new cookies with App-Bound Encryption (v20); decrypting those needs the amd64 Windows ABE build . See FAQ & Troubleshooting for failure modes that can leave encrypted fields blank.

See also