browserforensics
← Back to all articles

Chrome Local Storage & IndexedDB (LevelDB)

2026-05-19 · 1 min

Beyond SQLite, Chrome keeps web-app state in LevelDB key/value stores — frequently overlooked, often rich with evidence (logged-in identities, drafts, app caches).

Where it lives (inside the profile)

Local Storage/leveldb/      # window.localStorage per origin
Session Storage/            # per-tab session storage
IndexedDB/<origin>.indexeddb.leveldb/   # structured app databases

Each is a folder of CURRENT, MANIFEST-*, *.ldb and *.log files — not a single file.

How to read it

LevelDB needs the whole directory: SSTables (.ldb), the write-ahead log (.log), Snappy block decompression, and — for IndexedDB — V8 structured-clone decoding of values.

  • Local Storage keys are _<origin>\0<key>; values carry a 1-byte encoding prefix.
  • Session Storage uses a namespace→map indirection.
  • IndexedDB values are V8-serialized; simple records decode cleanly, complex ones fall back to a preview.

Try it

Upload the whole profile folder. This parser groups each LevelDB directory, parses it client-side, and presents Local/Session Storage as origin/key/value tables (IndexedDB best-effort). Nothing is uploaded.