restore
Decrypt copied Chromium profile data using exported master keys.
restore decrypts Chromium-based browser data collected on another machine, using master keys exported with dumpkeys and profile files bundled with archive.
Note
The
dumpkeys/archive/restoreworkflow is Chromium-only. It does not restore Firefox or Safari profiles.
Flags
| Flag | Default | Description |
|---|---|---|
--keys | required | Keys file from dumpkeys (use - for stdin) |
--data-zip | No | Archive zip from archive (exactly one of --data-zip/--data-dir) |
--data-dir | No | Copied profile dir (archive layout, or one browser’s User Data with --browser) |
-b, --browser | "" (all vaults) | Restore only this browser; the empty default restores every vault in the keys file |
-c, --category | all | Data categories (comma-separated), or all |
-f, --format | json | Output format: json, csv, or cookie-editor |
-d, --dir | results | Output directory, created if missing |
--zip | false | Pack the output into <dir>/<dir name>.zip |
restore writes the same results/ output as a local dump — see Output & Data Formats — and prints the same run summary. A vault whose data is missing from the copy is skipped with a warning; naming a --browser that has no vault in the keys file is an error.
When selecting one vault, use its canonical browser key from Supported Browsers, not the display name printed by list.
Examples
# From a dumpkeys keys file plus an archive zip
hack-browser-data restore --keys keys.json --data-zip data.zip
# One browser from a copied User Data directory
hack-browser-data restore --keys keys.json --data-dir ./chrome-userdata --browser chromeFor the full origin → analyst walkthrough and the SSH-streaming variant, see Cross-Host Decryption.