browserforensics
Back to all articles

Where browsers store their artifacts

2026-05-18 · 1 min

Modern browsers keep most of their user data in SQLite databases. That is good news for analysis: you can open them read-only and query them directly — which is exactly what this tool does, entirely in your browser.

Chrome / Edge (Chromium)

Inside the profile directory:

  • History — visited URLs, visit timestamps, downloads, typed search terms.
  • Cookies — cookie metadata (values are encrypted on disk).
  • Web Data — autofill form values.
  • Login Data — saved login metadata (passwords are encrypted).
  • Bookmarks — a JSON file, not SQLite.

Chromium timestamps are microseconds since 1601-01-01 UTC.

Firefox

  • places.sqlite — history and bookmarks.
  • cookies.sqlite — cookies.
  • formhistory.sqlite — saved form values.

Firefox timestamps are microseconds since the Unix epoch.

Safari

  • History.db — history items and visits.

Safari uses Mac absolute time: seconds since 2001-01-01 UTC.

Drop any of these files into the parser to see the records — the file never leaves your machine.