HackBrowserData: Open Source Browsers & Extensions

What is HackBrowserData?

HackBrowserData is an MIT-licensed command-line tool written in Go that decrypts and exports browser data — passwords, cookies, history, bookmarks, credit cards, downloads, extensions, localStorage and sessionStorage — from Chromium-based browsers, Firefox, and Safari for security research on Windows, macOS and Linux.

What it is

HackBrowserData is a command-line utility, distributed under the MIT licence and written in Go, that reads the profile stores of an installed browser and decrypts the contents into exportable form. It lives in the browser forensics and penetration-testing corner of the toolchain, filed in this registry under Productivity & Utilities / Browsers & Extensions alongside the pentest-tool, hacking, chrome, edge and firefox topics.

The concrete problem it solves is the per-browser, per-platform grind of getting data out of a profile: each engine stores and encrypts differently, and some decryption requires the origin machine's key material. HackBrowserData replaces that ad hoc work with one binary that handles the extraction, so an operator does not need the browser installed, or even the same operating system, on the analysing host. It explicitly supports cross-host decryption: master keys are exported on the origin host and a copy of the data is decrypted offline elsewhere, including for browsers whose OS the analyst machine cannot run.

Key capabilities

Exports nine data categories on Chromium-based browsers: Password, Cookie, Bookmark, History, Download, Credit Card, Extension, LocalStorage and SessionStorage; Firefox covers all but Credit Card and SessionStorage, and Safari covers Password, Cookie, Bookmark, History, Download, Extension and LocalStorage.
Covers Chrome, Chrome Beta, Chromium, Edge, Brave, Opera, OperaGX, Vivaldi, Yandex, CocCoc, Arc, DuckDuckGo, QQ, 360 ChromeX, 360 Chrome, DC Browser, Sogou Explorer, Firefox and Safari across the platforms each one ships on.
Provides a cross-host workflow with three subcommands: archive to pull the profile files, dumpkeys to export master keys on the origin host, and restore to decrypt on macOS or Linux — the route for Windows-only browsers such as QQ, 360 Chrome and Sogou Explorer.
Supports Chromium 127+ App-Bound Encryption cookies on Windows (Chrome, Chrome Beta, Edge, Brave, CocCoc) through a payload built with make build-windows.
Reads Safari data on macOS once Full Disk Access is granted in System Settings → Privacy & Security → Full Disk Access.
Builds and cross-compiles from source with Go 1.20+ via go build ./cmd/hack-browser-data/ and GOOS/GOARCH targets, with CI covering lint, build, release and tests.

Who uses it and how

Penetration testers and security researchers working an authorised engagement against Windows, macOS or Linux endpoints, where the binary is run directly after downloading the release for the host system.
Incident responders and forensic analysts who archive a profile on one machine and decrypt the copy offline on another, keeping analysis off the origin host.
Analysts on macOS or Linux who need data from Windows-only browsers, using archive and dumpkeys on the Windows machine and restore on their own.
macOS operators extracting from Chromium-based browsers that require the current user's password before decryption succeeds.

Getting started

Download the release for your system from the GitHub releases page and run the binary; building from source instead requires Go 1.20+, then git clone, cd HackBrowserData and go build ./cmd/hack-browser-data/. The project homepage is at hackbrowserdata.org.

How it compares

The facts supplied for this entry name no paid products that HackBrowserData replaces, and no comparable open-source tools either. On the evidence available it stands alone in this registry, as the only browser-data extraction and decryption utility listed here.

When to use it — and when not to

A self-hoster or operator must accept real operational friction: Windows Defender and other antivirus products may flag and block the binary, Safari extraction returns empty results without Full Disk Access, password decryption may fail on macOS 26.4 or later, and Chromium 127+ cookie decryption on Windows needs a custom make build-windows build rather than the stock release. Anyone without explicit authorisation over the machine and profile in question should not use it at all, since the README states it is intended for security research only, with users carrying all legal liability.

project readme (upstream, from github) — read inline

HackBrowserData

HackBrowserData is a command-line tool for decrypting and exporting browser data (passwords, history, cookies, bookmarks, credit cards, download history, localStorage, sessionStorage and extensions) from the browser. It supports the most popular Chromium-based browsers and Firefox on Windows, macOS and Linux, plus Safari on macOS.

It can also decrypt data across machines and operating systems: export the master keys on the origin host, then decrypt a copy of the data offline on any other host — even for a browser that the analyst host's OS cannot run (see Cross-host decryption).

Disclaimer: This tool is only intended for security research. Users are responsible for all legal and related liabilities resulting from the use of this tool. The original author does not assume any legal responsibility.

Supported Data Categories

Category	Chromium-based	Firefox	Safari
Password	✅	✅	✅
Cookie	✅	✅	✅
Bookmark	✅	✅	✅
History	✅	✅	✅
Download	✅	✅	✅
Credit Card	✅	-	-
Extension	✅	✅	✅
LocalStorage	✅	✅	✅
SessionStorage	✅	-	-

Supported Browsers

On macOS, some Chromium-based browsers require a current user password to decrypt.

Password decryption may fail on macOS 26.4 or later.

Browser	Windows	macOS	Linux
Chrome	✅²	✅	✅
Chrome Beta	✅²	✅	✅
Chromium	✅	✅	✅
Edge	✅²	✅	✅
Brave	✅²	✅	✅
Opera	✅	✅	✅
OperaGX	✅	✅	-
Vivaldi	✅	✅	✅
Yandex	✅	✅	-
CocCoc	✅²	✅	-
Arc	✅	✅	-
DuckDuckGo³	✅	-	-
QQ³	✅	-	-
360 ChromeX³	✅	-	-
360 Chrome³	✅	-	-
DC Browser³	✅	-	-
Sogou Explorer³	✅	-	-
Firefox	✅	✅	✅
Safari¹	-	✅	-

¹ Safari requires Full Disk Access; enable it in System Settings → Privacy & Security → Full Disk Access if extraction returns empty results.

² On Windows, decrypting Chromium 127+ cookies (Chrome / Chrome Beta / Edge / Brave / CocCoc) requires the App-Bound Encryption payload built via make build-windows — see Building from source below.

³ These browsers ship only on Windows, but their data is decryptable on any OS: pull the files with archive, export the keys with dumpkeys, then decrypt on macOS or Linux with restore — see Cross-host decryption.

Getting Started

Install

Installation of HackBrowserData is dead-simple, just download the release for your system and run the binary.

In some situations, this security tool will be treated as a virus by Windows Defender or other antivirus software and can not be executed. The code is all open source, you can modify and compile by yourself.

Building from source

Requires Go 1.20+.

git clone https://github.com/moonD4rk/HackBrowserData
cd HackBrowserData
go build ./cmd/hack-browser-data/

Cross-platform build

# For Windows (standard build, no Chromium 127+ ABE cookie support)
GOOS=windows GOARCH=amd64 go build ./cmd/hack-browser-data/

# For Linux
GOOS=linux GOARCH=amd64 go build ./cmd/hack-browser-data/

Windows build with App-Bound Encryption (optional)

Chrome / Chrome Beta / Edge / Brave / CocCoc 127+ protect cookies with App-Bound Encryption. Decrypting those cookies requires a small C payload — Zig (0.13+) is the recommended C toolchain (the Makefile calls zig cc). MinGW-w64 gcc can also build the sources manually if you bypass make payload.

# 1. Install Zig
brew install zig                 # macOS
scoop install zig                # Windows (scoop)
# or download from https://ziglang.org/download/

# 2. Build the payload (outputs crypto/windows/payload/abe_extractor_amd64.bin)
make payload

# 3. Build hack-browser-data.exe with the ABE payload embedded
make build-windows

The resulting hack-browser-data.exe includes full ABE cookie decryption on Chromium 127+.

Usage

$ hack-browser-data -h
hack-browser-data decrypts and exports browser data from Chromium-based
browsers and Firefox on Windows, macOS, and Linux.

GitHub: https://github.com/moonD4rk/HackBrowserData

Usage:
  hack-browser-data [flags]
  hack-browser-data [command]

Available Commands:
  archive     Pack decryption-relevant profile files into a zip for cross-host restore
  dump        Extract and decrypt browser data (default command)
  dumpkeys    Export Chromium master keys as JSON for cross-host decryption
  help        Help about any command
  list        List detected browsers and profiles
  restore     Decrypt copied profile data using exported master keys
  version     Print version information

Flags:
  -b, --browser string        target browser: all|chrome|firefox|edge|... (default "all")
  -c, --category string       data categories (comma-separated): all|password,cookie,... (default "all")
  -d, --dir string            output directory (default "results")
  -f, --format string         output format: csv|json|cookie-editor (default "json")
  -h, --help                  help for hack-browser-data
      --keychain-pw string    macOS keychain password
  -p, --profile-path string   custom profile dir path, get with chrome://version
  -v, --verbose               enable debug logging
      --zip                   compress output to zip

Use "hack-browser-data [command] --help" for more information about a command.

`dump` - Extract and decrypt browser data (default)

Running hack-browser-data without a subcommand defaults to dump.

Flag	Short	Default	Description
`--browser`	`-b`	`all`	Target browser (all\|chrome\|firefox\|edge\|...)
`--category`	`-c`	`all`	Data categories, comma-separated (all\|password\|cookie\|bookmark\|history\|download\|creditcard\|extension\|localstorage\|sessionstorage)
`--format`	`-f`	`json`	Output format (csv\|json\|cookie-editor)
`--dir`	`-d`	`results`	Output directory
`--profile-path`	`-p`		Custom profile dir path, get with chrome://version
`--keychain-pw`			macOS keychain password
`--zip`		`false`	Compress output to zip

Frequently asked questions

Is HackBrowserData free to use?

HackBrowserData is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does HackBrowserData do?

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

What is HackBrowserData written in?

HackBrowserData is primarily written in Go. Its source is publicly available at https://github.com/moonD4rk/HackBrowserData, and it has 14,534 GitHub stars.