tool · one of 34free, no counter
Cookies
What has this site put on my machine - cookies, localStorage, IndexedDB and the rest?
A page can only see the cookies that are not HttpOnly, which excludes almost every session cookie that matters. That is why Cookies is the one feature here that asks for a permission in order to *read* something, and it asks for exactly one origin rather than a wildcard, from the press that needs it, with a button to hand the access back. The other four stores ask for nothing at all - `localStorage`, `sessionStorage`, IndexedDB and Cache Storage are the page’s own APIs, and Developer → Site data lists them, opens one value at a time on request, edits the two that can be written and clears any of them by row or by store.
Reach itPress ⌘+K on any tab and type cookies.Ctrl+Kon Windows and Linux
TWO BUILDS9 browsers
Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome buildin the panel · free, no counter
What this actually is
every cookie the browser holds for this site, httponly ones includedDebugging a login, checking a `SameSite` value against what the server thinks it set, or clearing one cookie without clearing a whole site’s state. And the question next to it - which flag a feature switch is holding in `localStorage`, whether a token survived a sign-out, which assets a service worker actually cached - where the answer used to mean opening DevTools and walking a tree.
The four stores beside the cookie jar
Developer → Site data · no permission asked for any of them- localStorage
- Survives the tab closing, which is why preferences and tokens end up here. Keys with their character counts; a value opened on request and printed formatted where it parses as JSON; edited in place, added, or deleted a key at a time.
- sessionStorage
- Dies with the tab. Usually a draft, or a step part-way through a flow. Read, edited and cleared exactly as above - the two web-storage stores are the two that can be written.
- IndexedDB
- Database names, and a clear per database. Contents are deliberately not read: listing them means opening a connection, which can block on the page’s own and changes the state of something the panel is only meant to be looking at. Firefox has no way for a page to list its own databases, and that answers "could not ask" rather than "none".
- Cache Storage
- What a service worker stored, as one request URL per line rather than the bodies - the question is which assets are cached, not what is in them. Clearing a cache forces the next load onto the network. Needs a secure context, so an `http` page has none to show.
Asked about this tool
6 of themWhy does it ask for a permission when nothing else here does?
Because HttpOnly cookies are invisible to a page by design, so reading them needs the browser’s cookie API. The permission is optional, scoped to one origin, and returnable from inside the tool. The four site-data stores need none of it - they are read through the page’s own APIs.
Can I edit a localStorage value, or only clear it?
Edit it, add a key, or delete one. `localStorage` and `sessionStorage` are the two stores a write can be honoured in, so they are the two that show a pencil. A refused write - a full store, a key the page has taken back - keeps your draft and keeps the old value, and says which it was.
Why can I see IndexedDB database names but not what is in them?
Reading a database means opening a connection to it. That can block on the connection the page itself is holding, and it changes the state of something this panel exists to look at rather than touch. Names and a clear are what can be offered without that.
Why is the permission request made in a separate window?
The browser refuses a permission request outside a top-level extension context, so the floating panel physically cannot ask - it returned false with no dialog, which looked like a refusal nobody made.
Why is a value masked with fixed-width dots?
Because a mask that matched the value’s length still tells anybody looking over your shoulder how long the session token is.
It says my edit was refused. Why?
Some combinations are rejected by the browser - `SameSite=None` without `Secure`, a `__Host-` name with a path. The refusal is surfaced, because an editor that appears to save and changes nothing is the worst possible outcome on a screen showing somebody their session.
TWO BUILDS9 browsers
Chromelisting in reviewFirefoxlisting in reviewBravelisting in reviewOperalisting in reviewEdgelisting in review4 moreChromium browsers: Arc, Vivaldi, Chromium, Opera GXthe Chrome build63 of these · no host permissions · three free audits