HackBrowserData

Extract and decrypt browser data, supporting multiple data types, runnable on various operating systems (macOS, Windows, Linux).

14,529

1,813

14,529

View on GitHub

Top Related Projects

firefox_decrypt

2,472

Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

hindsight

1,506

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

Quick Overview

HackBrowserData is an open-source tool designed to decrypt and extract sensitive data from web browsers. It supports multiple browsers across different operating systems, allowing users to recover passwords, cookies, bookmarks, and history.

Pros

Cross-platform support (Windows, macOS, Linux)
Supports multiple popular browsers (Chrome, Edge, Firefox, etc.)
Exports data in various formats (CSV, JSON, SQLite3)
Active development and regular updates

Cons

Potential for misuse in unethical or illegal activities
May be flagged by antivirus software as a potential threat
Requires elevated privileges to access browser data
Limited documentation for advanced usage scenarios

Code Examples

// Initialize a new browser instance
browser := core.NewBrowser("chrome", "", true)

// Decrypt and retrieve passwords
passwords, err := browser.GetPasswords()
if err != nil {
    log.Fatal(err)
}

// Print decrypted passwords
for _, password := range passwords {
    fmt.Printf("URL: %s, Username: %s, Password: %s\n", password.URL, password.Username, password.Password)
}

// Export browser data to JSON file
exporter := export.NewJSONExporter("output.json")
err := exporter.Export(browser.GetAllData())
if err != nil {
    log.Fatal(err)
}

// Retrieve and print browser history
history, err := browser.GetHistory()
if err != nil {
    log.Fatal(err)
}

for _, entry := range history {
    fmt.Printf("Title: %s, URL: %s, Visit Count: %d\n", entry.Title, entry.URL, entry.VisitCount)
}

Getting Started

To use HackBrowserData, follow these steps:

Install Go (version 1.19 or later)

Clone the repository:

git clone https://github.com/moonD4rk/HackBrowserData.git

Build the project:
```
cd HackBrowserData
go build
```
Run the tool:
```
./hack-browser-data
```

For more detailed usage instructions and options, refer to the project's README file on GitHub.

Competitor Comparisons

firefox_decrypt

2,472

Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

Pros of firefox_decrypt

Focused specifically on Firefox, providing deep expertise for this browser
Lightweight and simple to use, with minimal dependencies
Supports multiple Firefox-based browsers (e.g., Thunderbird, SeaMonkey)

Cons of firefox_decrypt

Limited to Firefox and related browsers, unlike HackBrowserData's multi-browser support
Lacks a graphical user interface, which HackBrowserData provides
Does not offer additional features like cookie extraction or history retrieval

Code Comparison

firefox_decrypt:

def decrypt_passwords(profile, password=None):
    """Decrypt requested profile using the provided password"""
    if password:
        credentials.key = credentials.key3_decrypt(password)

    logins = credentials.decrypt_passwords(profile)
    return logins

HackBrowserData:

func DecryptChromePassword(encryptPass []byte) (string, error) {
    if len(encryptPass) > 3 && bytes.Equal(encryptPass[:3], []byte("v10")) {
        return decryptAES256GCM(encryptPass[3:])
    }
    return string(encryptPass), nil
}

Both projects focus on decrypting browser data, but firefox_decrypt is tailored specifically for Firefox-based browsers, while HackBrowserData offers a more comprehensive solution for multiple browsers. The code snippets demonstrate the different approaches and languages used in each project.

hindsight

1,506

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

Error generating comparison

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

README

HackBrowserData

HackBrowserData is a command-line tool for decrypting and exporting browser data (passwords, history, cookies, bookmarks, credit cards, download history, localStorage, sessionStorage and extensions) from the browser. It supports the most popular Chromium-based browsers and Firefox on Windows, macOS and Linux, plus Safari on macOS.

It can also decrypt data across machines and operating systems: export the master keys on the origin host, then decrypt a copy of the data offline on any other host â even for a browser that the analyst host's OS cannot run (see Cross-host decryption).

Disclaimer: This tool is only intended for security research. Users are responsible for all legal and related liabilities resulting from the use of this tool. The original author does not assume any legal responsibility.

Supported Data Categories

Category	Chromium-based	Firefox	Safari
Password	â	â	â
Cookie	â	â	â
Bookmark	â	â	â
History	â	â	â
Download	â	â	â
Credit Card	â	-	-
Extension	â	â	â
LocalStorage	â	â	â
SessionStorage	â	-	-

Supported Browsers

On macOS, some Chromium-based browsers require a current user password to decrypt.

Password decryption may fail on macOS 26.4 or later.

Browser	Windows	macOS	Linux
Chrome	âÂ²	â	â
Chrome Beta	âÂ²	â	â
Chromium	â	â	â
Edge	âÂ²	â	â
Brave	âÂ²	â	â
Opera	â	â	â
OperaGX	â	â	-
Vivaldi	â	â	â
Yandex	â	â	-
CocCoc	âÂ²	â	-
Arc	â	â	-
DuckDuckGoÂ³	â	-	-
QQÂ³	â	-	-
360 ChromeXÂ³	â	-	-
360 ChromeÂ³	â	-	-
DC BrowserÂ³	â	-	-
Sogou ExplorerÂ³	â	-	-
Firefox	â	â	â
SafariÂ¹	-	â	-

Â¹ Safari requires Full Disk Access; enable it in System Settings â Privacy & Security â Full Disk Access if extraction returns empty results.

Â² On Windows, decrypting Chromium 127+ cookies (Chrome / Chrome Beta / Edge / Brave / CocCoc) requires the App-Bound Encryption payload built via make build-windows â see Building from source below.

Â³ These browsers ship only on Windows, but their data is decryptable on any OS: pull the files with archive, export the keys with dumpkeys, then decrypt on macOS or Linux with restore â see Cross-host decryption.

Getting Started

Install

Installation of HackBrowserData is dead-simple, just download the release for your system and run the binary.

In some situations, this security tool will be treated as a virus by Windows Defender or other antivirus software and can not be executed. The code is all open source, you can modify and compile by yourself.

Building from source

Requires Go 1.20+.

git clone https://github.com/moonD4rk/HackBrowserData
cd HackBrowserData
go build ./cmd/hack-browser-data/

Cross-platform build

# For Windows (standard build, no Chromium 127+ ABE cookie support)
GOOS=windows GOARCH=amd64 go build ./cmd/hack-browser-data/

# For Linux
GOOS=linux GOARCH=amd64 go build ./cmd/hack-browser-data/

Windows build with App-Bound Encryption (optional)

Chrome / Chrome Beta / Edge / Brave / CocCoc 127+ protect cookies with App-Bound Encryption. Decrypting those cookies requires a small C payload â Zig (0.13+) is the recommended C toolchain (the Makefile calls zig cc). MinGW-w64 gcc can also build the sources manually if you bypass make payload.

# 1. Install Zig
brew install zig                 # macOS
scoop install zig                # Windows (scoop)
# or download from https://ziglang.org/download/

# 2. Build the payload (outputs crypto/windows/payload/abe_extractor_amd64.bin)
make payload

# 3. Build hack-browser-data.exe with the ABE payload embedded
make build-windows

The resulting hack-browser-data.exe includes full ABE cookie decryption on Chromium 127+.

Usage

$ hack-browser-data -h
hack-browser-data decrypts and exports browser data from Chromium-based
browsers and Firefox on Windows, macOS, and Linux.

GitHub: https://github.com/moonD4rk/HackBrowserData

Usage:
  hack-browser-data [flags]
  hack-browser-data [command]

Available Commands:
  archive     Pack decryption-relevant profile files into a zip for cross-host restore
  dump        Extract and decrypt browser data (default command)
  dumpkeys    Export Chromium master keys as JSON for cross-host decryption
  help        Help about any command
  list        List detected browsers and profiles
  restore     Decrypt copied profile data using exported master keys
  version     Print version information

Flags:
  -b, --browser string        target browser: all|chrome|firefox|edge|... (default "all")
  -c, --category string       data categories (comma-separated): all|password,cookie,... (default "all")
  -d, --dir string            output directory (default "results")
  -f, --format string         output format: csv|json|cookie-editor (default "json")
  -h, --help                  help for hack-browser-data
      --keychain-pw string    macOS keychain password
  -p, --profile-path string   custom profile dir path, get with chrome://version
  -v, --verbose               enable debug logging
      --zip                   compress output to zip

Use "hack-browser-data [command] --help" for more information about a command.

`dump` - Extract and decrypt browser data (default)

Running hack-browser-data without a subcommand defaults to dump.

Flag	Short	Default	Description
`--browser`	`-b`	`all`	Target browser (all\|chrome\|firefox\|edge\|...)
`--category`	`-c`	`all`	Data categories, comma-separated (all\|password\|cookie\|bookmark\|history\|download\|creditcard\|extension\|localstorage\|sessionstorage)
`--format`	`-f`	`json`	Output format (csv\|json\|cookie-editor)
`--dir`	`-d`	`results`	Output directory
`--profile-path`	`-p`		Custom profile dir path, get with chrome://version
`--keychain-pw`			macOS keychain password
`--zip`		`false`	Compress output to zip

--format cookie-editor writes only cookies, as a JSON array matching the Cookie-Editor browser extension's import format; non-cookie categories are skipped.

Cross-host decryption

Decrypt browser data on an analyst host that was collected on a different origin host â including a browser whose engine the analyst's OS cannot even install (e.g. decrypt Sogou or QQ Browser data on macOS). Nothing platform-bound (DPAPI, macOS Keychain, Chrome App-Bound Encryption) has to leave the origin: the master keys are exported once, and decryption then runs entirely offline from a copy of the data.

The workflow uses three commands and two transportable artifacts:

Step	Host	Command	Produces
1	origin	`dumpkeys`	`keys.json` â portable master keys
2	origin	`archive`	`browser-data.zip` â only the files needed to decrypt
3	analyst	`restore`	decrypted output (csv / json / cookie-editor)

# On the origin host (any OS) â export the keys and pack the data
hack-browser-data dumpkeys -o keys.json
hack-browser-data archive  -o browser-data.zip

# Copy keys.json + browser-data.zip to the analyst host, then decrypt offline
hack-browser-data restore --keys keys.json --data-zip browser-data.zip

keys.json contains plaintext master keys â treat it as a secret. dumpkeys -o writes it with 0600 permissions; prefer streaming it over a secure channel instead of leaving it on disk.

`dumpkeys` - Export master keys for cross-host decryption

Derives each Chromium installation's master keys on the origin host and writes them as JSON (Firefox / Safari have no portable key and are skipped). Defaults to stdout so it can be piped over SSH.

Flag	Short	Default	Description
`--browser`	`-b`	`all`	Target browser (all\|chrome\|edge\|...)
`--output`	`-o`	stdout	Output file (written `0600`); stdout if omitted
`--keychain-pw`			macOS keychain password

`archive` - Pack decryption-relevant files for transport

Collects only the files a restore actually needs (cookies, login data, history, â¦) through the same locked-file bypass used for extraction, so live SQLite files are read safely on Windows. The zip is laid out as <browser-key>/<User Data layout>, so one archive can carry several browsers and restore stays unambiguous. Entry names are always forward-slash, so a Windows-produced archive restores on macOS / Linux.

Flag	Short	Default	Description
`--browser`	`-b`	`all`	Target browser (all\|chrome\|edge\|...)
`--category`	`-c`	`all`	Data categories, comma-separated
`--output`	`-o`	`browser-data.zip`	Output archive path

`restore` - Decrypt copied data with exported keys

Rebuilds each Chromium engine straight from keys.json and decrypts the supplied data â it never consults the analyst's local browser table, so the browsers you can restore are exactly the vaults in your keys.json. Supply the data one of two ways (exactly one is required):

--data-zip â a zip produced by archive; extracted to a temp dir and removed afterward.
--data-dir â a directory. Either the archive layout (<browser-key>/..., several browsers at once), or one browser's hand-copied User Data root, which is unambiguous only for a single browser â so pair it with -b.

-b is an optional filter over the dump's vaults, not a required selector.

Flag	Short	Default	Description
`--keys`		required	Keys file from `dumpkeys` (use `-` for stdin)
`--data-zip`			Zip from `archive` (mutually exclusive with `--data-dir`)
`--data-dir`			Copied data dir (mutually exclusive with `--data-zip`)
`--browser`	`-b`		Restore only this browser; must match a vault in `--keys`
`--category`	`-c`	`all`	Data categories, comma-separated
`--format`	`-f`	`json`	Output format (csv\|json\|cookie-editor)
`--dir`	`-d`	`results`	Output directory
`--zip`		`false`	Compress output to zip

Cross-host examples

# Stream keys over SSH (no keys.json on disk), data copied separately
ssh origin "hack-browser-data dumpkeys" | \
  hack-browser-data restore --keys - --data-zip browser-data.zip

# Restore one browser from a hand-copied User Data folder (no archive)
hack-browser-data restore --keys keys.json --data-dir ./chrome-userdata -b chrome

`list` - List detected browsers and profiles

Flag	Default	Description
`--detail`	`false`	Show per-category entry counts

`version` - Print version information

hack-browser-data version

Global flags

Flag	Short	Description
`--verbose`	`-v`	Enable debug logging

Examples

# Extract all data from all browsers (default)
hack-browser-data

# Extract specific browser and categories
hack-browser-data dump -b chrome -c password,cookie

# Export in CSV format to a custom directory (JSON is the default)
hack-browser-data dump -b chrome -f csv -d output

# Export cookies in CookieEditor format
hack-browser-data dump -f cookie-editor

# Compress output to zip
hack-browser-data dump --zip

# List detected browsers and profiles
hack-browser-data list

# List with per-category entry counts
hack-browser-data list --detail

# Use custom profile path
hack-browser-data dump -b chrome -p "/path/to/User Data/Default"

Contributing

We welcome and appreciate any contributions made by the community (GitHub issues/pull requests, email feedback, etc.).

Please see the Contribution Guide before contributing.

Contributors

_Roger	_{Aquilao Official}	_uinfziuna8n	_slimwang	_stevenlele	_Cyrus
_{Carlo Mandelli}	_{David Rogers}	_zznQ	_YuXJ	_{mybonesaremorepowerful92}	_mirefly
_LC	_zhe6652	_guoguangwu	_freddy77	_beichen	_{Santiago Ramirez}
_{Ciprian Conache}	_a-urth	_Amir.

Stargazers over time

404StarLink 2.0 - Galaxy

HackBrowserData is a part of 404Team StarLink-Galaxy, if you have any questions about HackBrowserData or want to find a partner to communicate with, please refer to the Starlink group.

JetBrains OS licenses

HackBrowserData had been being developed with GoLand IDE under the free JetBrains Open Source license(s) granted by JetBrains s.r.o., hence I would like to express my thanks here.

Top Related Projects

firefox_decrypt

2,472

Firefox Decrypt is a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles

hindsight

1,506

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

Convert designs to code with AI

Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.

Try Visual Copilot

HackBrowserData

Top Related Projects

firefox_decrypt

hindsight

Quick Overview

Pros

Cons

Code Examples

Getting Started

Competitor Comparisons

firefox_decrypt

Pros of firefox_decrypt

Cons of firefox_decrypt

Code Comparison

hindsight

Convert designs to code with AI

README

HackBrowserData

Supported Data Categories

Supported Browsers

Getting Started

Install

Building from source

Cross-platform build

Windows build with App-Bound Encryption (optional)

Usage

dump - Extract and decrypt browser data (default)

Cross-host decryption

dumpkeys - Export master keys for cross-host decryption

archive - Pack decryption-relevant files for transport

restore - Decrypt copied data with exported keys

Cross-host examples

list - List detected browsers and profiles

version - Print version information

Global flags

Examples

Contributing

Contributors

Stargazers over time

404StarLink 2.0 - Galaxy

JetBrains OS licenses

Top Related Projects

firefox_decrypt

hindsight

Convert designs to code with AI

`dump` - Extract and decrypt browser data (default)

`dumpkeys` - Export master keys for cross-host decryption

`archive` - Pack decryption-relevant files for transport

`restore` - Decrypt copied data with exported keys

`list` - List detected browsers and profiles

`version` - Print version information