HackBrowserData

Decrypt & Export Safari Data

Export Safari passwords, cookies, history, and bookmarks on macOS — the Full Disk Access requirement and Keychain-backed passwords.

HackBrowserData exports Safari data on macOS. Safari is sandboxed, so its data lives under protected, container-scoped paths, and its passwords come from the macOS login Keychain rather than a file. Reaching any of it requires Full Disk Access.

Warning

For authorized security research and DFIR only. Run it on systems and accounts you own or are explicitly permitted to assess — see About .

What you can extract

ExtractedNot currently extracted
Password, Cookie, Bookmark, History, Download, Extension, Local StorageCredit Card, Session Storage

See the category matrix .

Commands

bash
# Everything Safari has (macOS)
hack-browser-data dump --browser safari

# Just history and bookmarks
hack-browser-data dump --browser safari --category history,bookmark

safari is the --browser key. Output is one file per non-empty category — see Output & Data Formats .

Grant Full Disk Access first

Safari’s files sit under protected locations, so the terminal (or the binary) running HackBrowserData needs Full Disk Access (FDA). Without it Safari returns nothing — an empty result is almost always a missing FDA grant, not a decryption failure.

  1. Open System Settings → Privacy & Security → Full Disk Access.
  2. Add and enable your terminal app (Terminal, iTerm, …) — or the hack-browser-data binary itself.
  3. Quit and reopen the terminal so the new permission takes effect, then run the command again.

Safari passwords

Safari keeps passwords as Keychain records, not in a file, so HackBrowserData reads them directly from the login Keychain. Everything else — cookies, history, bookmarks, downloads, extensions, local storage — is parsed from Safari’s container files with no per-item decryption.

Note

When Safari is selected, HackBrowserData asks for the current macOS login password in the terminal. If the login Keychain cannot be unlocked, password entries can still appear as metadata only (URL and account, with a blank password). Keychain-backed password decryption may fail on macOS 26.4 or later; sudo alone is not a guaranteed workaround.

Where Safari stores data

  • ~/Library/Safari — history, bookmarks, downloads.
  • ~/Library/Containers/com.apple.Safari/Data/Library — cookies and local storage (the sandboxed WebKit store).

Named profiles are handled automatically; bookmarks, extensions, and passwords come from shared locations and are reported under the default profile.

See also