RunLocalTools

Storage & Cookie Inspector — View, Decode, and Compare localStorage, sessionStorage, and Cookies

Inspect this site’s own localStorage, sessionStorage, and cookies, or paste an export from anywhere to decode JSON and JWTs, audit cookie flags, and diff two snapshots — free, nothing uploaded.

This tool has two jobs: show you exactly what’s sitting in this page’s own browser storage, and let you paste in a storage or cookie export from anywhere else to inspect, decode, and compare it. A page can never read another site’s storage directly — that’s a browser security boundary, not a limitation here — so pasting an export is the way to look at data from elsewhere.

How to use it

To inspect this page’s own storage:

  1. Open the “This page” tab — localStorage, sessionStorage, and cookies for this site load automatically.
  2. Use Edit or Delete on any localStorage or sessionStorage row to change it directly (cookies are shown read-only, since a page can’t see cookie flags and can’t reliably delete a cookie without knowing its exact original path).
  3. Click “View as JSON,” “Decode JWT,” or “Decode base64” on any row where those are offered, to see what a value actually contains.

To inspect an export from another site:

  1. In your browser’s DevTools Console on that site, run the snippet from the “Paste export” tab — it copies a JSON snapshot to your clipboard.
  2. Paste it into the text box here. The format is auto-detected — this tool’s own JSON shape, a Cookie-Editor export, a Netscape cookies.txt file, a raw cookie header, or one Set-Cookie line per cookie all work.
  3. Review the table, export it back out as JSON, or move to the “Compare two” tab to diff it against an earlier snapshot.

Features

  • This-page live view — localStorage, sessionStorage, and cookies for the current site, with add/edit/delete for local and session storage.
  • Auto-detected paste formats — this tool’s own JSON export, a Cookie-Editor JSON array, a Netscape cookies.txt file, a raw name=value; name2=value2 cookie header, or one Set-Cookie line per cookie.
  • Recursive JSON decoding — storage values are frequently JSON encoded as a string inside another JSON value; this decodes nested JSON inline instead of showing an unreadable escaped blob.
  • JWT and base64 decoding — one click reveals a JWT’s header and payload (never verifying the signature — that needs the issuer’s key), or plain-text content hiding behind base64.
  • Privacy scan — flags values that look like an email address, UUID, phone number, coordinate pair, or JWT, as a heuristic hint worth a second look, not a certainty claim.
  • Cookie flag audit — for any cookie parsed with attributes (a Cookie-Editor export or Set-Cookie lines, not live document.cookie, which the browser never exposes flags through), flags a missing Secure, HttpOnly, or SameSite setting, or an expiration already in the past.
  • Snapshot diff — paste two JSON snapshots and see exactly what was added, removed, or changed between them, useful for tracking down what a login flow or a specific action actually writes to storage.
  • IndexedDB database listing — names and versions of this site’s IndexedDB databases, where the browser supports listing them.
  • Nothing leaves your browser — pasted data is never uploaded or sent anywhere; it only exists in this tab.

FAQ

Can this read another website’s localStorage or cookies directly?

No. No browser tool can — reading another origin’s storage from a web page is blocked by the browser itself, not something this tool chooses to restrict. To inspect another site’s data, you paste an export from it (via the DevTools snippet or an export from that site’s own tools).

Why can’t I see flags like Secure or HttpOnly on my own site’s cookies here?

Browsers deliberately don’t expose cookie attributes to JavaScript’s document.cookie — only the name and value. The flag audit only works on pasted data that already includes attributes, such as a Cookie-Editor export or Set-Cookie header text.

Is the “possible token/secret” or “email address” flag definitely correct?

No — it’s a pattern match, not a guarantee. A flagged value might be entirely harmless, and something sensitive might not match any pattern. Treat the flags as a prompt to look closer, not a verdict.

Does deleting a cookie here actually work?

Only for localStorage and sessionStorage, which always delete cleanly. Live cookies are shown read-only, because reliably deleting a cookie requires knowing its exact original path and domain, which JavaScript cannot read back from document.cookie — use your browser’s DevTools → Application → Cookies panel for that.

What format does the diff tool expect?

This tool’s own JSON snapshot shape — the same one the DevTools snippet produces, or the “Use this page’s current storage” button fills in automatically. Other formats (cookies.txt, raw headers) aren’t accepted for diffing, since comparing two different formats against each other would be ambiguous.

Is anything I paste here sent to a server?

No. Parsing, decoding, and diffing all happen in your browser. Nothing you paste is uploaded anywhere.