browserforensics

Browser artifact parser

Inspect history, cookies, bookmarks, downloads and autofill from Chrome, Firefox and Safari — entirely client-side.

100% private: files are parsed in a Web Worker on your machine and never leave your browser.

Parse a browser artifact

Drop a file here or click to select

Supported: SQLite databases, Chrome Bookmarks & Local State JSON, Firefox .jsonlz4 sessions, Safari .plist & .binarycookies. Drop multiple files or a whole profile folder.

Tip: in the file dialog hold ⌘ (or Shift) to select several files at once. You can also drag a whole profile folder onto this area — that pairs -wal/-journal sidecars and groups LevelDB stores.

Where do I find these files?

Profile paths per browser and OS. <profile> is usually "Default".

Chrome

  • Windows%LOCALAPPDATA%\Google\Chrome\User Data\<profile>
  • macOS~/Library/Application Support/Google/Chrome/<profile>
  • Linux~/.config/google-chrome/<profile>

Artifacts: History · Network/Cookies · Login Data · Web Data · Bookmarks · Cache/Cache_Data/

For decryption:
  • AES key…\User Data\Local State
  • DPAPI masterkey (Windows)%APPDATA%\Microsoft\Protect\<SID>\<GUID>

Edge

  • Windows%LOCALAPPDATA%\Microsoft\Edge\User Data\<profile>
  • macOS~/Library/Application Support/Microsoft Edge/<profile>
  • Linux~/.config/microsoft-edge/<profile>

Artifacts: History · Network/Cookies · Login Data · Web Data · Bookmarks · Cache/Cache_Data/

For decryption:
  • AES key…\User Data\Local State
  • DPAPI masterkey (Windows)%APPDATA%\Microsoft\Protect\<SID>\<GUID>

Brave · Opera · Vivaldi

Chromium-based — same files, same os_crypt key scheme.

  • Windows%LOCALAPPDATA%\BraveSoftware\Brave-Browser\User Data\<profile>
  • macOS~/Library/Application Support/BraveSoftware/Brave-Browser/<profile>
  • Linux~/.config/BraveSoftware/Brave-Browser/<profile>

Artifacts: History · Network/Cookies · Login Data · Web Data · Bookmarks · Cache/Cache_Data/

For decryption:
  • AES key…\User Data\Local State

Firefox

Cookies are cleartext; passwords need logins.json + key4.db.

  • Windows%APPDATA%\Mozilla\Firefox\Profiles\<profile>
  • macOS~/Library/Application Support/Firefox/Profiles/<profile>
  • Linux~/.mozilla/firefox/<profile>

Artifacts: places.sqlite · cookies.sqlite · formhistory.sqlite · logins.json · key4.db / key3.db · *.jsonlz4 · cache2/entries/

Safari

macOS only. Cookies live in the app container.

  • Data~/Library/Safari/
  • Cookies~/Library/Containers/com.apple.Safari/Data/Library/Cookies/

Artifacts: History.db · Bookmarks.plist · Cookies.binarycookies · Cache.db

Supported artifacts

  • • Chrome / Edge: History, Cookies, Web Data (autofill), Login Data, Bookmarks
  • • Firefox: places.sqlite, cookies.sqlite, formhistory.sqlite
  • • Safari: History.db