🍪 Cookie Sync
Sync cookies across browsers using GitHub Gist with end-to-end encryption.
Features
- E2E Encryption: All data encrypted with AES-256-GCM before leaving your browser
- GitHub Gist Storage: Uses private GitHub Gist as cloud storage
- Multi-domain Support: Sync cookies for any website
- Selective Sync: Choose specific cookies to sync or sync all
- PIN Protection: Local PIN protects your encryption password
- Privacy-focused: Even filenames are encrypted (HMAC with PBKDF2)
Security Model
| Data |
Storage Location |
Encryption |
| Cookies |
GitHub Gist |
✅ AES-256-GCM |
| Filenames |
GitHub Gist |
✅ PBKDF2-HMAC (unidentifiable) |
| GitHub Token |
Tampermonkey Storage |
✅ AES-256-GCM |
| Encryption Password |
Tampermonkey Storage |
✅ AES-256-GCM (with PIN) |
| PIN |
Browser sessionStorage |
Plaintext (RAM only) |
| Gist ID |
Tampermonkey Storage |
Plaintext (public identifier) |
Encryption Details
- Algorithm: AES-256-GCM with random IV (12 bytes) and salt (16 bytes)
- Key Derivation: PBKDF2-SHA256 with 100,000 iterations
- Filename Privacy: Domain names are hashed using HMAC-SHA256 with a PBKDF2-derived key, output as 15-character base62 string (~89 bits entropy)
PIN Behavior
- Stored in
sessionStorage (browser RAM)
- Cleared when browser exits
- Per-origin: Must enter PIN once per website per session
- Never syncs to Tampermonkey cloud or anywhere else
Installation
- Install Tampermonkey browser extension
- Install the script from Greasy Fork or manually
- Grant required permissions when prompted
Required Permissions
GM_cookie - Read/write cookiesGM_setValue/getValue - Store encrypted settingsGM_xmlhttpRequest - Connect to GitHub API
Setup
1. Create GitHub Token
- Go to GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens
- Click "Generate new token"
- Set expiration as needed
- Under "Account permissions", grant Gists: Read and write
- Generate and copy the token
2. Configure Cookie Sync
- Click Tampermonkey icon → Cookie Sync → Open Cookie Sync
- Go to Settings tab
- Set up encryption:
- Enter a strong Encryption Password (used for E2E encryption)
- Enter a PIN (4+ characters, protects password locally)
- Click Set Up Encryption
- Paste your GitHub token
- Click Save Settings
Usage
Push Cookies (Upload)
- Visit the website whose cookies you want to sync
- Open Cookie Sync panel
- (Optional) Go to Cookies tab to select specific cookies
- Click Push or use Tampermonkey menu → Push Cookies
- Enter PIN if prompted
Pull Cookies (Download)
- Visit the website on another browser/device
- Ensure same Gist ID and password are configured
- Click Pull or use Tampermonkey menu → Pull Cookies
- Enter PIN if prompted
- Cookies are applied to current browser
Quick Access
Use Tampermonkey menu for quick actions without opening the panel:
- 🍪 Open Cookie Sync - Open full panel
- ⬆️ Push Cookies - Quick push for current site
- ⬇️ Pull Cookies - Quick pull for current site
Sync Another Browser
- Install Tampermonkey and Cookie Sync on the new browser
- Configure with:
- Same encryption password
- Same GitHub token (or create a new one)
- Same Gist ID (copy from first browser's Settings tab)
- Pull cookies for desired sites
File Structure in Gist
cookie-sync-metadata.json # Encrypted: list of synced domains
K7mXp2NqR5vLs9Y.json # Encrypted: cookies for domain A
x9Qm4Lp8Wn2Rv7B.json # Encrypted: cookies for domain B
Filenames are HMAC-hashed, so no one can identify which domains you're syncing.
Troubleshooting
"GitHub token not configured"
→ Enter your GitHub token in Settings and click Save
"PIN required"
→ Enter your PIN when prompted (set during initial setup)
"Failed to decrypt token - wrong password?"
→ Password mismatch. Ensure same password on all browsers
"No synced data found for [domain]"
→ Push cookies from another browser first, or check Gist ID matches
Cookies not applying
→ Some cookies (HttpOnly, Secure flags) may have browser restrictions. Check the error details in the status message.
Privacy Notice
- Your data never touches any server except GitHub (encrypted)
- Anthropic/developers cannot read your cookies - only you have the password
- GitHub cannot read your cookies - all content is encrypted
- Filenames reveal nothing - domain names are hashed
License
MIT
Author
hxueh
