browserforensics
Back to all articles

Safari history file locations

2026-05-19 · 1 min

On modern macOS, Safari data is split between the classic ~/Library/Safari folder and the app's sandbox container.

Paths (macOS)

/Users/<username>/Library/Safari
/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Cookies
/Users/<username>/Library/Containers/com.apple.Safari/Data/Library/Preferences

What each file holds

FileFormatContents
History.dbSQLiteVisits (history_visits) + URLs (history_items)
Bookmarks.plistBinary plistBookmarks
Downloads.plistBinary plistDownload records
LastSession.plistBinary plistSession / open tabs
RecentlyClosedTabs.plistBinary plistRecently closed tabs
Cookies.binarycookiesbinarycookiesCookies
com.apple.Safari.plistBinary plistSettings & recent searches
favicons.dbSQLiteFavicon metadata/images

Timestamps

Safari uses Mac absolute time — seconds since 2001‑01‑01 UTC. The parser handles History.db, Bookmarks.plist and Cookies.binarycookies and converts these timestamps for you.


Reference: Foxton Forensics — Safari history location.