Why this exists. A web page can only read its own site's data — that's the same-origin policy,
and it's what stops a random site reading your bank's session. So our
Browser Privacy & Storage Analyzer
can only ever show you
our storage. This bookmarklet doesn't break that rule — it works inside it,
by running the same checks
on the site you're actually looking at.
📖 Setting It Up
Takes about thirty seconds, once. Watch it first if you'd rather see the whole thing before installing anything.
The whole thing end to end — drag it to the bar, open a site, click once.
StepWhat to do
1
Show your bookmarks bar
Press Ctrl+Shift+B on Windows, or ⌘+Shift+B on a Mac. In Safari it's View → Show Favourites Bar.
2
Drag the 🔖 button onto it
Drag, don't click. It becomes a normal-looking bookmark that happens to hold code instead of a web address.
3
Go to the site you want to inspect
Somewhere you're signed in is the interesting case — that's where tokens and session data actually live.
4
Click the bookmark
A panel appears in the bottom-right listing everything that site has stored. Click Close and it removes itself completely.
🔍 What It Shows You
localStorage
Data the site keeps permanently — it survives closing the browser entirely.
sessionStorage
Data that disappears when you close the tab.
Cookies
Only the ones JavaScript is allowed to read. HttpOnly cookies stay hidden — see below.
JWT tokens
Anything shaped like a login token gets flagged, so you can see whether the site is leaving credentials somewhere scripts can reach.
Likely secrets
Keys named like token, auth, session or api_key are marked and their values masked.
🚫 What It Still Can't Show
Running inside a site widens what's readable — it doesn't remove every limit.
HttpOnly cookies
Hidden from all JavaScript by design. If a site's session cookie doesn't appear, that's the site doing security properly.
Saved passwords
Live in the browser's own vault, which no page can touch.
Browsing history
A page can count entries in the current tab and nothing more.
Other sites
Still one site at a time. Run it again on the next site.
The disk cache
No page can enumerate it, anywhere, ever.
🛡️ Is This Safe?
A fair question, and one you should be asking about any bookmarklet.
Makes any network requestNo — none at all
Sends data to usNo
Changes anything on the siteNo — read only
Stays after you close itNo — removes itself
Masks secret-looking valuesYes, by default
Source you can read firstYes — below
Be careful with bookmarklets generally. One runs with full access to whatever site you're on,
so a malicious one could read your session and send it away. Attackers exploit exactly this — it's called
self-XSS, and it's why browser consoles print those big red "don't paste anything here" warnings.
Ours is about twenty lines and does nothing but read and display. Read it below before you trust it,
and apply the same suspicion to any bookmarklet anyone hands you, including this one.
Read the full source
