chrome-cookie-extractor
Advanced tools
Extract and decrypt Chrome cookies with curl integration - includes auth-curl command for authenticated requests
A TypeScript/Node.js tool to extract cookies from Chrome and Brave browsers and convert them to curl-compatible formats.
npm install -g chrome-cookie-extractor
After installation, you'll have access to two commands:
chrome-cookies - Extract cookies to files or formatsauth-curl - NEW! curl with automatic authenticationnpm install chrome-cookie-extractor
npx chrome-cookie-extractor --help
npx chrome-cookie-extractor auth-curl https://example.com
The easiest way to use this tool! auth-curl automatically extracts cookies for any domain and uses them with curl:
# Access any authenticated site with your Chrome session
auth-curl https://github.com/user/repo
# Get your Google account info
auth-curl https://myaccount.google.com/profile
# API calls with authentication
auth-curl https://api.github.com/user
# POST requests with authentication
auth-curl https://api.example.com/data -X POST -d '{"key":"value"}' --json
# Save response to file
auth-curl https://private-site.com/data.json -o data.json
# Verbose output to see what's happening
auth-curl https://example.com -v
# Set curl timeouts (passed through to curl)
auth-curl https://example.com/slow --max-time 20 --connect-timeout 5
# Any flag auth-curl does not handle itself is forwarded straight to curl,
# so it works as a drop-in curl wrapper (e.g. -sL, --retry, --http2)
auth-curl -sL --retry 3 https://example.com
Passthrough:
auth-curlforwards any unknown curl flag (in order, with its value) to the underlyingcurlinvocation, on top of injecting your Chrome cookies and default headers. This lets curl-style commands and generated checkers (e.g.auth-curl --max-time 25 -sL "$URL") work unchanged.
# Extract all cookies to cookies.txt
chrome-cookies
# Extract cookies for a specific domain
chrome-cookies -d google.com
# List available browser profiles
chrome-cookies --list-profiles
# Save as Netscape format (default)
chrome-cookies -d example.com -o my-cookies.txt
# Output as curl header
chrome-cookies -d example.com --curl
# Output as JSON
chrome-cookies -d example.com --json
# Extract from specific profile
chrome-cookies -p "Profile 1" -d github.com
# Verbose output with detailed information
chrome-cookies -d example.com --verbose
# Combine with curl
COOKIES=$(chrome-cookies -d example.com --curl)
curl $COOKIES https://example.com/api
| Option | Description |
|---|---|
<url> | URL to request (required) |
-v, --verbose | Show detailed output including cookies found |
-o, --output <file> | Write response to file instead of stdout |
-H, --header <header> | Add custom header (can be used multiple times) |
-X, --request <method> | HTTP method (GET, POST, etc.) |
-d, --data <data> | HTTP POST data |
--json | Send data as JSON and set content-type |
--follow-redirects | Follow HTTP redirects |
--insecure | Allow insecure SSL connections |
--max-time <seconds> | Maximum time in seconds for the whole operation (passed through to curl) |
--connect-timeout <seconds> | Maximum time in seconds for the connection phase (passed through to curl) |
| Option | Description |
|---|---|
-d, --domain <domain> | Extract cookies for specific domain only |
-o, --output <file> | Output file path (default: cookies.txt) |
-p, --profile <profile> | Chrome profile name (Default, Profile 1, etc.) |
--curl | Output in curl header format |
--json | Output in JSON format |
--list-profiles | List available Chrome/Brave profiles |
--verbose | Verbose output with detailed information |
--help | Show help information |
--version | Show version number |
# Generate cookies file
chrome-cookies -d example.com
# Use with curl
curl -b cookies.txt https://example.com/api
# Get curl header format and use directly
COOKIES=$(chrome-cookies -d example.com --curl)
curl $COOKIES https://example.com/api
curl $(chrome-cookies -d example.com --curl) https://example.com/api
This tool now supports full decryption of Chrome's encrypted cookies on macOS:
import { ChromeCookieExtractor } from 'chrome-cookie-extractor';
const extractor = new ChromeCookieExtractor();
// Get available profiles
const profiles = extractor.getProfiles();
console.log('Available profiles:', profiles);
// Extract cookies
const cookies = await extractor.extractCookies({
domain: 'example.com',
profiles: ['Default']
});
// Format output
const curlFormat = extractor.formatAsCurl(cookies);
const jsonFormat = extractor.formatAsJson(cookies);
const netscapeFormat = extractor.formatAsNetscape(cookies);
⚠️ Important Security Notes:
--list-profiles to see available profiles# Extract Google authentication cookies
chrome-cookies -d google.com --curl
# Use with curl to access authenticated Google services
GOOGLE_COOKIES=$(chrome-cookies -d google.com --curl)
curl $GOOGLE_COOKIES "https://myaccount.google.com/profile"
# Extract GitHub cookies for API access
chrome-cookies -d github.com -o github-cookies.txt
curl -b github-cookies.txt "https://api.github.com/user"
import requests
# Extract cookies using the tool
cookies = subprocess.check_output(['chrome-cookies', '-d', 'example.com', '--json'])
cookie_dict = json.loads(cookies)
# Convert to requests format
session = requests.Session()
for cookie in cookie_dict:
session.cookies.set(cookie['name'], cookie['value'], domain=cookie['domain'])
response = session.get('https://example.com/api')
# Generate cookies file
chrome-cookies -d example.com
# Use with wget
wget --load-cookies cookies.txt https://example.com/file.zip
#!/bin/bash
# Extract cookies for multiple domains
for domain in "github.com" "google.com" "stackoverflow.com"; do
echo "Extracting cookies for $domain..."
chrome-cookies -d "$domain" -o "${domain}.cookies.txt"
done
git clone https://github.com/pchuri/chrome-cookie-extractor
cd chrome-cookie-extractor
# Install dependencies
npm install
# Build the project
npm run build
# Run locally
npm start -- --help
# Create binary executables
npm run package
MIT License - see LICENSE file for details
FAQs
Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.