browserforensics
Back to all articles

Chrome history file locations

2026-05-19 · 2 min

Google Chrome keeps its profile data in a per-user directory. The interesting artifacts (history, cookies, autofill, logins…) live in the Default profile folder (additional profiles are Profile 1, Profile 2, …).

Profile folder by operating system

Windows

C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default
C:\Users\<username>\AppData\Local\Google\Chrome\User Data\Default\Cache

macOS

/Users/<username>/Library/Application Support/Google/Chrome/Default
/Users/<username>/Library/Caches/Google/Chrome/Default/Cache

Linux

/home/<username>/.config/google-chrome/Default
/home/<username>/.cache/google-chrome/Default/Cache

What each file holds

DataFileFormatWhere inside
Website visitsHistorySQLiteurls, visits
SearchesHistorySQLitekeyword_search_terms, urls
DownloadsHistorySQLitedownloads, downloads_url_chains
CookiesCookies (in Network/)SQLitecookies
Form historyWeb DataSQLiteautofill
LoginsLogin DataSQLitelogins
FaviconsFaviconsSQLitefavicons, favicon_bitmaps, icon_mapping
ThumbnailsTop SitesSQLitethumbnails
BookmarksBookmarksJSON
Browser settingsPreferencesJSON
Session dataSession, TabsFile-basedSessions/ folder
Cacheindex, data_#, f_######CustomCache/ folder

Note: recent versions of Chrome moved Cookies into a Network sub-folder of the profile directory.

Timestamps

Chrome's SQLite timestamps (e.g. urls.last_visit_time, visits.visit_time) are stored as microseconds since 1601‑01‑01 UTC (the Windows/WebKit epoch), not the Unix epoch. This parser converts them for you automatically — drop a History file on the home page to see decoded times.


Reference: Foxton Forensics — Chrome history location.