HackBrowserData - Extract and decrypt browser data, supporting multi

项目说明

<di="center">
<img src="LOGO.png" alt="hack-browser-data logo" width="440px" />
</div>

HackBrowserData

![Lint]() ![Build]() ![Release]() ![Tests]() ![codecov]()

HackBrowserData is a command-line 工具 for decrypting and exporting browser data (passwords, history, cookies, bookmarks, credit cards, download history, localStorage, sessionStorage and extensions) from the browser. It supports the most popular Chromium-based browsers and Firefox on Windows, macOS and Linux, plus Safari on macOS.

It can also decrypt data across machines and operating systems: export the master keys on the origin host, then decrypt a copy of the data offline on any other host — even for a browser that the analyst host's OS cannot run (see Cross-host decryption).

> Disclaimer: This 工具 is only intended for security research. Users are responsible for all legal and related liabilities resulting from the use of this 工具. The original author does not assume any legal responsibility.

Supported Data Categories

| Category | Chromium-based | Firefox | Safari |
|:---------------|:--------------:|:-------:|:------:|
| Password | ✅ | ✅ | ✅ |
| Cookie | ✅ | ✅ | ✅ |
| Bookmark | ✅ | ✅ | ✅ |
| History | ✅ | ✅ | ✅ |
| Download | ✅ | ✅ | ✅ |
| Credit Card | ✅ | - | - |
| Extension | ✅ | ✅ | ✅ |
| LocalStorage | ✅ | ✅ | ✅ |
| SessionStorage | ✅ | - | - |

Supported Browsers

> On macOS, some Chromium-based browsers require a current user password to decrypt.
>
> Password decryption may fail on macOS 26.4 or later.

| Browser | Windows | macOS | Linux |
|:---------------|:-------:|:-----:|:-----:|
| Chrome | ✅² | ✅ | ✅ |
| Chrome Beta | ✅² | ✅ | ✅ |
| Chromium | ✅ | ✅ | ✅ |
| Edge | ✅² | ✅ | ✅ |
| Brave | ✅² | ✅ | ✅ |
| Opera | ✅ | ✅ | ✅ |
| OperaGX | ✅ | ✅ | - |
| | ✅ | ✅ | ✅ |
| Yandex | ✅ | ✅ | - |
| CocCoc | ✅² | ✅ | - |
| Arc | ✅ | ✅ | - |
| DuckDuckGo³ | ✅ | - | - |
| QQ³ | ✅ | - | - |
| 360 ChromeX³ | ✅ | - | - |
| 360 Chrome³ | ✅ | - | - |
| DC Browser³ | ✅ | - | - |
| Sogou Explorer³| ✅ | - | - |
| Firefox | ✅ | ✅ | ✅ |
| Safari¹ | - | ✅ | - |

> ¹ Safari requires Full Disk Access; enable it in System Settings → Privacy & Security → Full Disk Access if extraction returns empty results.
>
> ² On Windows, decrypting Chromium 127+ cookies (Chrome / Chrome Beta / Edge / Brave / CocCoc) requires the App-Bound Encryption payload built via make build-windows — see Building from source below.
>
> ³ These browsers ship only on Windows, but their data is decryptable on any OS: pull the files with archive, export the keys with dumpkeys, then decrypt on macOS or Linux with restore — see Cross-host decryption.

Getting Started

Install

Installation of HackBrowserData is dead-simple, just download the release for your system and run the binary.

> In some situations, this security 工具 will be treated as a virus by Windows Defender or other antivirus software and can not be executed. The 代码 is all open 源码, you can modify and compile by yourself.

Building from source

Requires Go 1.20+.

#### Cross-platform build

#### Windows build with App-Bound Encryption (optional)

Chrome / Chrome Beta / Edge / Brave / CocCoc 127+ protect cookies with App-Bound Encryption. Decrypting those cookies requires a small C payload — Zig (0.13+) is the recommended C toolchain (the Makefile calls zig cc). MinGW-w64 gcc can also build the sources manually if you bypass make payload.

The resulting hack-browser-data.exe includes full ABE cookie decryption on Chromium 127+.

Usage

dump - Extract and decrypt browser data (default)

Running hack-browser-data without a subcommand defaults to dump.

| Flag | Short | Default | Description |
|------------------|-------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------|
| --browser | -b | all | Target browser (all\|chrome\|firefox\|edge\|...) |
| --category | -c | all | Data categories, comma-separated (all\|password\|cookie\|bookmark\|history\|download\|creditcard\|extension\|localstorage\|sessionstorage) |
| --format | -f | json | Output format (csv\|json\|cookie-editor) |
| --dir | -d | results | Output directory |
| --profile-path | -p | | Custom profile dir path, get with chrome:// |
| --keychain-pw | | | macOS keychain password |
| --zip | | false | Compress output to zip |

> --format cookie-editor writes only cookies, as a JSON array matching the Cookie-Editor browser extension's import format; non-cookie categories are skipped.

Cross-host decryption

Decrypt browser data on an analyst host that was collected on a different origin host — including a browser whose 引擎 the analyst's OS cannot e (e.g. decrypt Sogou or QQ Browser data on macOS). Nothing platform-bound (DPAPI, macOS Keychain, Chrome App-Bound Encryption) has to leave the origin: the master keys are exported once, and decryption then runs entirely offline from a copy of the data.

The workflow uses three commands and two transportable artifacts:

| Step | Host | Command | Produces |
|------|------|---------|----------|
| 1 | origin | dumpkeys | keys.json — portable master keys |
| 2 | origin | archive | browser-data.zip — only the files needed to decrypt |
| 3 | analyst | restore | decrypted output (csv / json / cookie-editor) |

> keys.json contains plaintext master keys — treat it as a secret. dumpkeys -o writes it with 0600 permissions; prefer streaming it over a secure channel instead of leaving it on disk.

#### dumpkeys - Export master keys for cross-host decryption

Derives each Chromium installation's master keys on the origin host and writes them as JSON (Firefox / Safari have no portable key and are skipped). Defaults to stdout so it can be piped over SSH.

| Flag | Short | Default | Description |
|-----------------|-------|----------|-------------------------------------------------|
| --browser | -b | all | Target browser (all\|chrome\|edge\|...) |
| --output | -o | *stdout* | Output file (written 0600); stdout if omitted |
| --keychain-pw | | | macOS keychain password |

#### archive - Pack decryption-relevant files for transport

Collects only the files a restore actually needs (cookies, login data, history, …) through the same locked-file bypass used for extraction, so li files are read safely on Windows. The zip is laid out as <browser-key>/<User Data layout>, so one archive can carry several browsers and restore stays unambiguous. Entry names are always forward-slash, so a Windows-produced archi on macOS / Linux.

| Flag | Short | Default | Description |
|--------------|-------|--------------------|-----------------------------------------|
| --browser | -b | all | Target browser (all\|chrome\|edge\|...) |
| --category | -c | all | Data categories, comma-separated |
| --output | -o | browser-data.zip | Output archive path |

#### restore - Decrypt copied data with exported keys

Rebuilds each Chromium 引擎 straight from keys.json and decrypts the supplied data — it ne the analyst's local browser table, so the browsers you can restore are exactly the in your keys.json. Supply the data one of two ways (exactly one is required):

--data-zip — a zip produced by archive; extracted to a temp dir and remo.

--data-dir — a directory. Either the archive layout (<browser-key>/..., several browsers at once), or one browser's hand-copied User Data root, which is unambiguous only for a single browser — so pair it with -b.

-b is an optional filter over the dump's , not a required selector.

| Flag | Short | Default | Description |
|--------------|-------|------------|------------------------------------------------------------|
| --keys | | *required* | Keys file from dumpkeys (use - for stdin) |
| --data-zip | | | Zip from archive (mutually exclusive with --data-dir) |
| --data-dir | | | Copied data dir (mutually exclusive with --data-zip) |
| --browser | -b | | Restore only this browser; must match a vault in --keys |
| --category | -c | all | Data categories, comma-separated |
| --format | -f | json | Output format (csv\|json\|cookie-editor) |
| --dir | -d | results | Output directory |
| --zip | | false | Compress output to zip |

#### Cross-host examples

list - List detected browsers and profiles

| Flag | Default | Description |
|------------|---------|--------------------------------|
| --detail | false | Show per-category entry counts |

- Print information

Global flags

| Flag | Short | Description |
|-------------|-------|----------------------|
| -- | -v | Enable debug logging |

Examples

Contributing

We welcome and appreciate any contributions made by the community (GitHub issues/pull requests, email feedback, etc.).

Please see the Contribution Guide before contributing.

Contributors

<!-- readme: collaborators,contributors -start -->
<table>
<tbody>
<tr>
<td align="center">
<a href="
<img src=" width="100;" alt="moonD4rk"/>
<br />
_<b>Roger</b>
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="Aquilao"/>
<br />
_{<b>Aquilao Official</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="uinfziuna8n"/>
<br />
_{<b>uinfziuna8n</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="slimwang"/>
<br />
_{<b>slimwang</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="ste"/>
<br />
_<b>ste</b>
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="VMpc"/>
<br />
_<b>Cyrus</b>
</a>
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="100;" alt="camandel"/>
<br />
_{<b>Carlo Mandelli</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="drogers0"/>
<br />
_<b>Da</b>
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="ac0d3r"/>
<br />
_<b>zznQ</b>
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="slark-yuxj"/>
<br />
_<b>YuXJ</b>
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="mybonesaremorepowerful92"/>
<br />
_{<b>mybonesaremorepowerful92</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="mirefly"/>
<br />
_{<b>mirefly</b>}
</a>
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="100;" alt="lc6464"/>
<br />
_<b>LC</b>
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="zhe6652"/>
<br />
_{<b>zhe6652</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="testwill"/>
<br />
_{<b>guoguangwu</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="freddy77"/>
<br />
_{<b>freddy77</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="BeichenDream"/>
<br />
_{<b>beichen</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="SantiiRepair"/>
<br />
_{<b>Santiago Ramirez</b>}
</a>
</td>
</tr>
<tr>
<td align="center">
<a href="
<img src=" width="100;" alt="DUptain1993"/>
<br />
_{<b>Daniel Uptain </b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="dexhek"/>
<br />
_{<b>Ciprian Conache</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="a-urth"/>
<br />
_{<b>a-urth</b>}
</a>
</td>
<td align="center">
<a href="
<img src=" width="100;" alt="Amir-78"/>
<br />
_<b>Amir.</b>
</a>
</td>
</tr>
<tbody>
</table>
<!-- readme: collaborators,contributors -end -->

Stargazers over time

![Star History Chart]()

404StarLink 2.0 - Galaxy

HackBrowserData is a part of 404Team StarLink-Galaxy, if you have any questions about HackBrowserData or want to find a partner to communicate with, please refer to the Starlink group.
<a href=" target="_blank"><img src=" align="middle"/></a>

JetBrains OS licenses

HackBrowserData had been being de with GoLand IDE under the free JetBrains Open Source license(s) granted by JetBrains s.r.o., hence I would like to express my thanks here.

<a href=" target="_blank"><img src=" width="256" align="middle"/></a>

项目信息

开发语言：Go

Star 数：14584

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。