Skip to content
Get packs

Guide · Open source

How to use HackBrowserData: install, run and export browser data

Updated · written with AI from the project's own documentation and checked against our catalogue data

HackBrowserData is an open-source command-line tool that reads browser profile files and exports and decrypts data such as passwords, history, cookies and bookmarks. This guide covers installing it, running the dump command, choosing browsers and data categories, and the Windows and macOS caveats. It is written for people with authorization to examine the machine and browser data in question, such as security researchers, penetration testers and forensic analysts.

HackBrowserDatamoonD4rk/HackBrowserData · ★ 14.7k · MIT

Quick start

  1. 1Confirm authorization. Make sure you are permitted to examine the machine and its browser data. The README places legal responsibility on the user.
  2. 2Get the binary. Download a release for your system or build from source with Go 1.20+ using git clone and go build ./cmd/hack-browser-data/.
  3. 3List detected browsers. Run hack-browser-data list to see which browsers and profiles were found.
  4. 4Run a targeted dump. Use -b and -c to choose a browser and categories, and -f to pick csv, json or cookie-editor output.
  5. 5Handle platform requirements. On macOS, supply --keychain-pw if needed. On Windows, build the ABE payload for Chromium 127+ cookies.
  6. 6Review the output folder. Check the results directory, or the folder set with -d, for the exported files.

Check whether this tool fits your use case

The README says the tool is intended only for security research and places legal responsibility on the user. It decrypts stored credentials, so only run it on machines and browser profiles you are authorized to examine.

If you only want your own data back, a normal browser backup or export flow is the intended route rather than this tool.

  • Good fit: security research, authorized penetration tests, testing how your own profile is protected, forensic review with permission
  • Poor fit: recovering your own data through normal export, anyone without authorization, users who need a graphical interface

Install HackBrowserData

The simplest route is to download the release for your system from the project's releases page and run the binary. The README notes that antivirus software, including Windows Defender, may flag the tool and block it. Because the code is open source, you can also build it yourself.

Building from source requires Go 1.20 or later. Clone the repository, change into the directory and build the binary.

  • Requires Go 1.20+ only if building from source
  • Antivirus may flag the binary; the README says you can modify and compile it yourself
git clone https://github.com/moonD4rk/HackBrowserData cd HackBrowserData go build ./cmd/hack-browser-data/

Run your first dump

Running the binary with no subcommand defaults to dump, which extracts and decrypts browser data. With the defaults, it targets all browsers, all data categories, writes JSON output and saves results to a folder named results.

Run hack-browser-data -h to see the full list of commands and flags on your build. To limit the run, pick a browser with -b and categories with -c.

  • -b / --browser: all, chrome, firefox, edge and others (default all)
  • -c / --category: comma-separated, such as password,cookie (default all)
  • -f / --format: csv, json or cookie-editor (default json)
  • -d / --dir: output directory (default results)
  • --zip: compress output to a zip file
hack-browser-data -b chrome -c password,cookie -f json -d results

Choose browsers and data categories

The README lists Chromium-based browsers, Firefox on Windows, macOS and Linux, and Safari on macOS. Not every category is available for every browser. For example, credit card data is listed for Chromium-based browsers only, and sessionStorage is listed for Chromium-based browsers only.

If the tool cannot find a profile, the README points to -p / --profile-path, a custom profile directory you can find via chrome://version. The list command shows detected browsers and profiles.

  • Credit card: Chromium-based browsers only
  • SessionStorage: Chromium-based browsers only
  • Safari: macOS only, needs Full Disk Access if results are empty
  • Custom profile: use -p with the path from chrome://version
hack-browser-data list

Handle platform-specific requirements

On macOS, some Chromium-based browsers require your current user password to decrypt. The flag --keychain-pw takes the macOS keychain password. The README also warns that password decryption may fail on macOS 26.4 or later.

On Windows, decrypting Chromium 127+ cookies for Chrome, Chrome Beta, Edge, Brave and CocCoc requires an App-Bound Encryption payload. The README describes building it with make payload and then make build-windows, using Zig 0.13+ as the recommended C toolchain.

  • macOS keychain: --keychain-pw
  • Safari: enable Full Disk Access in System Settings under Privacy & Security
  • Windows ABE cookies: build with make payload then make build-windows
make payload make build-windows

Decrypt data from another machine

The README describes a cross-host workflow. On the origin machine, archive packs decryption-relevant profile files into a zip. dumpkeys exports Chromium master keys as JSON. On the analyst machine, restore decrypts the copied data using those keys. The README says this can work even for a browser the analyst's OS cannot run.

Some browsers such as DuckDuckGo, QQ and Sogou Explorer ship only on Windows, but their data can be decrypted on macOS or Linux with this workflow.

  • archive: pack profile files into a zip
  • dumpkeys: export Chromium master keys as JSON
  • restore: decrypt copied profile data with exported keys
hack-browser-data archive hack-browser-data dumpkeys hack-browser-data restore

What people use it for

  • Security researchers studying how Chromium and Firefox store passwords and cookies locally
  • Penetration testers reviewing exposed browser data during an authorized engagement
  • Developers checking how their own browser profile data is protected
  • Forensic analysts exporting data from profiles on machines they are permitted to examine

Frequently asked questions

Is HackBrowserData free to use?

The project is released under the MIT licence, as stated in its repository information. The README does not mention pricing for any other form of use.

What are the system requirements for HackBrowserData?

The README says the tool runs on Windows, macOS and Linux. Building from source requires Go 1.20 or later; downloading a release does not require Go.

Which browsers does HackBrowserData support?

It supports Chromium-based browsers such as Chrome, Edge, Brave, Opera and Vivaldi, plus Firefox on all three systems and Safari on macOS. Support varies by browser and OS, so check the README's browser table.

Why does antivirus flag HackBrowserData?

The README says security tools like this may be treated as a virus by Windows Defender or other antivirus software. Because the code is open source, you can review it and compile it yourself.

Why is Safari returning empty results on macOS?

The README says Safari requires Full Disk Access. Enable it in System Settings under Privacy & Security, then run the tool again.

Is there an alternative to HackBrowserData?

The project's analysis lists no comparable projects. For graphical or non-security workflows, a normal browser export or backup feature is the route the README suggests for recovering your own data.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

HackBrowserData suits security researchers, authorized penetration testers and forensic analysts who need to export and decrypt browser data from the command line. It is a poor choice for anyone who only wants their own data back through normal means, or who lacks authorization to access the target data.

Install options & downloads