HackBrowserData
On this page

archive

Pack Chromium profile files into a zip for cross-host restore.

archive bundles Chromium-based browser profile files into a single zip, ready to move to another machine and decrypt with restore. It needs no keys and does not decrypt anything during collection.

Note

archive is Chromium-only. Firefox and Safari are skipped because they do not implement this cross-host archive format.

Flags

FlagDefaultDescription
-b, --browserallTarget browser, or all
-c, --categoryallData categories (comma-separated), or all
-o, --outputbrowser-data.zipOutput archive path

--category accepts the same values as dump: password, cookie, bookmark, history, download, creditcard, extension, localstorage, sessionstorage.

Examples

bash
# Archive every detected Chromium browser's relevant files
hack-browser-data archive

# Archive just Chrome cookies into a named zip
hack-browser-data archive --browser chrome --category cookie --output chrome-cookies.zip
terminal
[INF] Archived 20 entries to browser-data.zip

An entry is one captured file or directory, such as Local Storage/leveldb. If nothing relevant is found, archive fails instead of writing an empty zip.

Archive layout

Each Chromium user data directory gets a top-level folder named after its browser key — a second Arc package on Windows becomes arc-2 — holding Local State and each profile’s files at their original relative paths:

text
browser-data.zip
  chrome/Local State
  chrome/Default/Login Data
  chrome/Default/Network/Cookies
  chrome/Default/History
  chrome/Profile 1/Login Data
  edge/Local State
  edge/Default/Login Data

restore --data-zip reads this layout directly, and so does --data-dir when pointed at an unpacked archive. The zip is written to a temporary file with owner-only permissions (0600) and renamed into place only when complete.

See Cross-Host Decryption for the full workflow.

The archive can contain encrypted credential databases plus plaintext browsing history, bookmarks, download paths, extensions, and storage. Treat it as sensitive even when it is stored separately from keys.json.