Status: LIVE on the Chrome Web Store (published 2026-07-15).
Also listed on Microsoft Edge Add-ons — that build is currently
v1.0.2, one release behind the Chrome Web Store (no Netscape import yet). See
docs/HANDOFF.md for current state.
License: GPL-3.0-or-later. Bokal bundles ExtPay, which is copyleft
(AGPL-3.0-or-later), so the combined work is conveyed under GPL-compatible terms — a permissive
license like MIT would not be compliant. Reasoning in
docs/licensing-notes.md; dependency licenses in
THIRD-PARTY-NOTICES.md.
What Bokal is
Bokal is a Manifest V3 cookie manager built around a single promise: your cookies never leave
your device. No server, no account, no telemetry, no analytics, no remote code. It reads and
writes cookies through Chrome's cookies API and does everything locally.
It's aimed at web developers debugging sessions and auth, QA engineers juggling multiple accounts
and login states, and privacy-conscious users who want to see and control what sites store.
Features (all free)
- Full cookie control — view, add, edit, and delete cookies, including
HttpOnly cookies that
UI-only tools can't touch.
- Search & filter, and view cookies for the current site or across all sites.
- Rules — protect cookies from deletion, pin important ones to the top, and block cookies from
specific domains (reactive cleanup in the background service worker).
- Whitelist cleanup — keep a list of sites to preserve, then clear everything else with one
click or an optional daily sweep (protected cookies are always kept).
- Cookie audit hints — flags missing
SameSite, unpartitioned cross-site cookies, and
oversized cookies inline.
- Export to JSON, Netscape (
cookies.txt), cookie-header, and test-automation formats
(Playwright storageState, Puppeteer) — no downloads permission needed.
- Import from JSON (Cookie-Editor / EditThisCookie compatible), Netscape
cookies.txt (incl.
curl's #HttpOnly_ marker), cookie-header strings, and Playwright/Puppeteer files, validated
before write.
- CHIPS partition inspector for modern partitioned cookies.
- DevTools panel — inspect and edit the current tab's cookies inside DevTools.
- Dark mode and virtualized lists that stay fast across thousands of cookies.
Cookie profiles — one free, unlimited with Pro
Save a site's cookies under a name and switch between saved sets (e.g. different test accounts) in
one click — restoring HttpOnly and partitioned cookies in place — with optional passphrase
encryption (AES-GCM + PBKDF2, 600k iterations). Profiles live only on your device in IndexedDB.
One profile is free, encryption included. Bokal Pro removes the limit: $29.99 once, $19.99 a
year, or $4.99 a month. If Pro lapses you keep every saved profile and can still apply or delete it;
only new saves are limited.
Privacy impact is deliberately minimal:
- The profiles code is code-split into a separate lazy chunk — it loads via dynamic
import()
only for Pro users or once you open Cookie profiles, and the always-loaded bundle contains none of
it. CI enforces this (check:bundle).
- Free users make zero network calls, including when they use their free profile. Billing (via
ExtPay → Stripe) is only ever contacted after you click Unlock Pro or
Restore purchase. See
docs/pro-monetization.md.
How Bokal compares
Being straight about this, because the obvious comparison is
Cookie-Editor (~2M users) and half of what you'd
expect to separate them doesn't. Cookie-Editor is also GPL-3.0, also Manifest V3 (since 2022), and
has also used optional_host_permissions rather than install-time site access since August 2023.
So "open source" and "no install-time host permissions" are not reasons to prefer Bokal.
What actually differs (verified against its published manifest.chrome.json, 2026-08-26):
| Bokal | Cookie-Editor |
|---|
tabs permission | not requested (uses activeTab) | requested |
| "Read your browsing history" at install | no | yes — consequence of tabs |
| Install-time site access | none (optional grant) | none (optional grant) |
| License | GPL-3.0 | GPL-3.0 |
| CHIPS partitioned cookies | partition inspector | no partitionKey handling |
Playwright storageState export | yes | no |
Puppeteer setCookie export | yes | no |
| Users / track record | small, launched 2026 | ~2M, 4.4★ |
| Browsers | Chrome / Chromium | Chrome, Edge, Firefox, Opera, Safari |
If you don't work with partitioned cookies or test automation and the browsing-history permission
doesn't bother you, Cookie-Editor is a good tool and you should use it. Longer write-up:
bokal.dev/cookie-editor-alternative.
Trust posture
Every privacy claim here is meant to be literally true against the code — that's the product.
- No
tabs permission — so no "read your browsing history" warning at install. (No
install-time host_permissions either, though as noted above that part is not unique.) Host access is
optional_host_permissions: ['<all_urls>'], requested at runtime for the specific site you're
managing (via activeTab to read the current URL), and only escalated to all-sites when you
explicitly open the all-cookies view, export all sites, or run cleanup.
- No remote code — everything Bokal runs is in the published package.
- Cookie values are never logged, and render as text nodes only (an XSS regression test locks
this). Enforced by
redaction.test.ts in CI.
- The published manifest is:
cookies, storage, sidePanel, unlimitedStorage, alarms, activeTab + optional <all_urls>.
Context: the permission landscape backs a minimal-permission stance — a peer-reviewed 2022 study
found only ~39.8% of Chrome Web Store extensions comply with the spirit of least
privilege. Bokal's threat model is
documented in docs/threat-model.md.
Repository layout
This is a pnpm monorepo.
apps/cookie-manager/ # the WXT + React + TypeScript extension (the product)
entrypoints/ # background.ts (service worker), sidepanel/ (App.tsx), devtools
lib/ # cookies/, io/, pay/, profiles/, rules/, security/, permissions, ...
stores/ # zustand stores (cookies, entitlement, rules, profiles)
components/ # CookieRow/List/Editor, IoBar, SearchBar, pro/ProfilesPanel (lazy)
e2e/ # Playwright fixtures + smoke/granted specs
packages/ui-kit/ # shared theme.css + useTheme
packages/tsconfig/ # shared TS config
site/ # landing page + hosted privacy policy (static)
docs/ # HANDOFF, threat-model, pro-monetization, store/, business/, specs
Getting started
Requires Node ≥ 24 and pnpm 9.9.0 (corepack enable will provide pnpm).
pnpm install
pnpm --filter @bokal/cookie-manager dev # WXT dev server
pnpm --filter @bokal/cookie-manager build # -> apps/cookie-manager/.output/chrome-mv3
Load apps/cookie-manager/.output/chrome-mv3 as an unpacked extension at chrome://extensions.
Verify
pnpm -r test # unit tests (vitest)
pnpm --filter @bokal/cookie-manager exec tsc --noEmit # type-check
pnpm --filter @bokal/cookie-manager build # production build
pnpm --filter @bokal/cookie-manager zip # -> .output/*.zip (store upload)
pnpm --filter @bokal/cookie-manager e2e # Playwright E2E (smoke)
CI (.github/workflows/ci.yml) runs type-check, unit tests, build, and
Playwright E2E against both the normal and E2E builds on every push and PR.
Guides
Contributing & security
See CONTRIBUTING.md for the development workflow and the invariants that keep
the trust posture true, and SECURITY.md to report a vulnerability.
License
GPL-3.0-or-later — see LICENSE. You are free to use, study, modify, and
redistribute Bokal; derivative works must remain under the same license. Third-party dependency
licenses are listed in THIRD-PARTY-NOTICES.md.
