Storage Inspector

Yes, completely, with no paid tier, no trial, no account and no usage limits. It is open source under the MIT licence.

No. The extension contains no network code at all — no fetch, no XMLHttpRequest, no WebSockets, no analytics and no telemetry. There is no server behind it to receive anything. Whatever it reads is rendered into its own interface and discarded when you close it. You can verify this yourself: the source is a few files of plain JavaScript with no dependencies and no build step, so what you read is exactly what runs.

No. There is nothing to sign up for, nothing to log into, and no way to identify you even if someone wanted to.

A storage inspector is only useful on whichever site you happen to be debugging, and it has no way to know in advance which sites those will be — an extension restricted to a fixed list of domains would not do the job. That access is used for one thing: running a read-only collector on the tab you explicitly select. It does not track browsing, run in the background, or touch pages you have not opened it on.

DevTools shows the six storage areas as six separate trees with no totals, partial size information, raw values and no analysis. Storage Inspector puts everything on one screen with a size on every key, decodes JSON and JWTs instead of printing them raw, searches across areas, ranks the largest keys, and runs a rule engine that flags insecure cookie flags, tracker keys, quota pressure and expired tokens. DevTools can edit values in place, which Storage Inspector deliberately does not do.

Yes, and this is one of the main reasons it exists as an extension rather than a bookmarklet. HttpOnly cookies are invisible to document.cookie by design — which means any page-script tool shows you an incomplete list, usually missing the session cookie you actually care about. Storage Inspector reads cookies through the browser's extension API, so it sees every one.

No. Every finding comes from an explicit rule — a comparison, a regular expression or a threshold — written out in the source. That means results are identical every time, instant, free, work offline, and can be checked line by line. An AI-based analyser would be slower, would cost money to run, would need your data sent to a server, and would occasionally invent things.

Any Chromium-based browser on version 116 or newer: Chrome, Edge, Brave, Opera, Arc, Vivaldi. Firefox and Safari use different extension APIs, so they are not supported today.

Loading an unpacked extension is a standard developer workflow built into Chrome — it is how every extension is tested before publication. The risk with any unpacked extension is trusting whoever wrote it, which is why this one is open source: you can read every line before you load it. Chrome will show a 'Developer mode extensions' notice on startup while any unpacked extension is installed; that is expected and not a warning about this specific extension.

Yes — the listing is being prepared and submitted for review. Once it is approved, an install button will appear on this page and updates will arrive automatically. Until then, the ZIP download is the same code and works identically; the only difference is that you update it manually.

A 0-100 number, with a letter grade, summarising what the analyser found on this origin. Critical findings cost 20 points each and warnings 6, while all informational notes together are capped at 6 — so a page with a lot of harmless notes still scores well, and one real security problem moves the needle. It is a summary, not a verdict: always read the findings themselves, because a site can score badly for reasons that are entirely deliberate.

It does exactly what the site itself could do, and what clearing site data in browser settings does — nothing lower-level or riskier. It is still real deletion: you will be logged out if you delete a session cookie, and unsaved local data is gone. Every delete asks for confirmation and lists what is about to go. Sites often recreate what they need on the next page load.

The full JSON export contains everything the scan read, including cookie values and tokens, plus the analysis. Treat it as sensitive. The redacted export replaces every value with a placeholder while keeping keys, sizes, flags, structure and findings intact — that is the one to attach to a bug report or share with a colleague. There is also a CSV for spreadsheets and a Markdown report for writing things up.

Chrome blocks every extension from scripting its own internal pages (chrome://), the Chrome Web Store, other extensions' pages, and view-source views — this is a browser rule, not a limitation of this extension. Local file:// pages work if you enable 'Allow access to file URLs' on the extension's details page. Storage Inspector tells you which of these applies rather than showing an empty screen.

No. It does nothing at all until you open it — there is no content script running on every page, no background polling and no listeners on your browsing. A scan happens only when you ask for one, and typically takes a few tens of milliseconds.

Reads are capped at 200 records per object store and 300 entries per cache so that a site holding hundreds of thousands of records cannot freeze the interface. Record counts and total sizes are still complete — only the displayed rows are limited — and the dashboard says explicitly when a list has been truncated.

A cached response only knows its exact size if it carries a Content-Length header. Where that is missing, the extension reads the body to measure it, but only for a bounded number of entries so a large cache cannot stall the scan. Anything estimated is marked as such.

The key name matches a pattern that conventionally holds a secret — access_token, session_id, api_key, jwt, password and similar. It is a name-based signal, not proof: a key called auth_prefs will be flagged and is probably harmless. The finding is a prompt to look, not a verdict.

By matching key names against a catalogue of well-known analytics, advertising, session-recording, support and A/B testing keys covering around 45 vendors — Google Analytics, Meta Pixel, Hotjar, Microsoft Clarity, Mixpanel, Amplitude, Segment, HubSpot and others. Matching happens entirely offline against a list shipped inside the extension. It names the vendor and what the key is for, rather than just labelling something a tracker.

Not currently. Storage Inspector reads and deletes; it does not write. Keeping it read-only means it cannot corrupt the state of a site you are debugging, which matters when you are already chasing a bug. DevTools handles in-place editing well if you need it.