Decrypt & Export Firefox Data

Decrypt and export Firefox passwords, cookies, history, and bookmarks on Windows, macOS, and Linux — what's supported and the Primary Password caveat.

HackBrowserData decrypts and exports Mozilla Firefox data on Windows, macOS, and Linux. Firefox uses its own crypto stack (NSS) and stores an encrypted key per profile in key4.db, so decryption runs entirely from the profile — no OS keychain, no sudo, nothing platform-specific.

Warning

For authorized security research and DFIR only. Run it on systems and accounts you own or are explicitly permitted to assess — see About .

#What you can extract

HackBrowserData does not currently extract Firefox payment-method data or session storage. That is a tool-support boundary, not a claim that Firefox or the Web platform lacks those features. See the category matrix .

#Commands

# Everything Firefox has
hack-browser-data dump --browser firefox

# Just saved logins, as CSV
hack-browser-data dump --browser firefox --category password --format csv

firefox is the --browser key. Output is one file per non-empty category — see Output & Data Formats .

#Where Firefox stores data

Profiles live under a per-OS directory, each in a randomly named subdirectory (for example 97nszz88.default-release):

Each category maps to a known file inside the profile:

Only saved logins are encrypted; everything else above is plaintext. The decryption key is reconstructed from key4.db automatically on each run.

#Caveat: Primary Password

If a profile is protected by a Primary Password (formerly “Master Password”), HackBrowserData does not prompt for, brute-force, or crack it. Saved-login rows may still be present, but their protected username and password fields can be blank. Cookies, history, bookmarks, downloads, extensions, and local storage do not depend on that password and can still export.

#See also

• Supported Browsers & Data · dump · How It Works
• Safari — the other non-Chromium engine. (dumpkeys is Chromium-only.)