Bokal

A trustworthy, open-source cookie manager for Chrome (Manifest V3).
View, edit, add, delete, import, and export cookies — with nothing leaving your device.

---

Status: LIVE on the Chrome Web Store (published 2026-07-15). Also listed on Microsoft Edge Add-ons — that build is currently v1.0.2, one release behind the Chrome Web Store (no Netscape import yet). See docs/HANDOFF.md for current state.

License: GPL-3.0-or-later. Bokal bundles ExtPay, which is copyleft (AGPL-3.0-or-later), so the combined work is conveyed under GPL-compatible terms — a permissive license like MIT would not be compliant. Reasoning in docs/licensing-notes.md; dependency licenses in THIRD-PARTY-NOTICES.md.

What Bokal is

Bokal is a Manifest V3 cookie manager built around a single promise: your cookies never leave your device. No server, no account, no telemetry, no analytics, no remote code. It reads and writes cookies through Chrome's cookies API and does everything locally.

It's aimed at web developers debugging sessions and auth, QA engineers juggling multiple accounts and login states, and privacy-conscious users who want to see and control what sites store.

Features (all free)

• Full cookie control — view, add, edit, and delete cookies, including HttpOnly cookies that UI-only tools can't touch.
• Search & filter, and view cookies for the current site or across all sites.
• Rules — protect cookies from deletion, pin important ones to the top, and block cookies from specific domains (reactive cleanup in the background service worker).
• Whitelist cleanup — keep a list of sites to preserve, then clear everything else with one click or an optional daily sweep (protected cookies are always kept).
• Cookie audit hints — flags missing SameSite, unpartitioned cross-site cookies, and oversized cookies inline.
• Export to JSON, Netscape (cookies.txt), cookie-header, and test-automation formats (Playwright storageState, Puppeteer) — no downloads permission needed.
• Import from JSON (Cookie-Editor / EditThisCookie compatible), Netscape cookies.txt (incl. curl's #HttpOnly_ marker), cookie-header strings, and Playwright/Puppeteer files, validated before write.
• CHIPS partition inspector for modern partitioned cookies.
• DevTools panel — inspect and edit the current tab's cookies inside DevTools.
• Dark mode and virtualized lists that stay fast across thousands of cookies.

Cookie profiles — one free, unlimited with Pro

Save a site's cookies under a name and switch between saved sets (e.g. different test accounts) in one click — restoring HttpOnly and partitioned cookies in place — with optional passphrase encryption (AES-GCM + PBKDF2, 600k iterations). Profiles live only on your device in IndexedDB.

One profile is free, encryption included. Bokal Pro removes the limit: $29.99 once, $19.99 a year, or $4.99 a month. If Pro lapses you keep every saved profile and can still apply or delete it; only new saves are limited.

Privacy impact is deliberately minimal:

• The profiles code is code-split into a separate lazy chunk — it loads via dynamic import() only for Pro users or once you open Cookie profiles, and the always-loaded bundle contains none of it. CI enforces this (check:bundle).
• Free users make zero network calls, including when they use their free profile. Billing (via ExtPay → Stripe) is only ever contacted after you click Unlock Pro or Restore purchase. See docs/pro-monetization.md.

How Bokal compares

Being straight about this, because the obvious comparison is Cookie-Editor (~2M users) and half of what you'd expect to separate them doesn't. Cookie-Editor is also GPL-3.0, also Manifest V3 (since 2022), and has also used optional_host_permissions rather than install-time site access since August 2023. So "open source" and "no install-time host permissions" are not reasons to prefer Bokal.

What actually differs (verified against its published manifest.chrome.json, 2026-08-26):

If you don't work with partitioned cookies or test automation and the browsing-history permission doesn't bother you, Cookie-Editor is a good tool and you should use it. Longer write-up: bokal.dev/cookie-editor-alternative.

Trust posture

Every privacy claim here is meant to be literally true against the code — that's the product.

• No tabs permission — so no "read your browsing history" warning at install. (No install-time host_permissions either, though as noted above that part is not unique.) Host access is optional_host_permissions: ['<all_urls>'], requested at runtime for the specific site you're managing (via activeTab to read the current URL), and only escalated to all-sites when you explicitly open the all-cookies view, export all sites, or run cleanup.
• No remote code — everything Bokal runs is in the published package.
• Cookie values are never logged, and render as text nodes only (an XSS regression test locks this). Enforced by redaction.test.ts in CI.
• The published manifest is: cookies, storage, sidePanel, unlimitedStorage, alarms, activeTab + optional <all_urls>.

Context: the permission landscape backs a minimal-permission stance — a peer-reviewed 2022 study found only ~39.8% of Chrome Web Store extensions comply with the spirit of least privilege. Bokal's threat model is documented in docs/threat-model.md.

Repository layout

This is a pnpm monorepo.

apps/cookie-manager/   # the WXT + React + TypeScript extension (the product)
  entrypoints/         #   background.ts (service worker), sidepanel/ (App.tsx), devtools
  lib/                 #   cookies/, io/, pay/, profiles/, rules/, security/, permissions, ...
  stores/              #   zustand stores (cookies, entitlement, rules, profiles)
  components/          #   CookieRow/List/Editor, IoBar, SearchBar, pro/ProfilesPanel (lazy)
  e2e/                 #   Playwright fixtures + smoke/granted specs
packages/ui-kit/       # shared theme.css + useTheme
packages/tsconfig/     # shared TS config
site/                  # landing page + hosted privacy policy (static)
docs/                  # HANDOFF, threat-model, pro-monetization, store/, business/, specs

Getting started

Requires Node ≥ 24 and pnpm 9.9.0 (corepack enable will provide pnpm).

pnpm install
pnpm --filter @bokal/cookie-manager dev      # WXT dev server
pnpm --filter @bokal/cookie-manager build     # -> apps/cookie-manager/.output/chrome-mv3

Load apps/cookie-manager/.output/chrome-mv3 as an unpacked extension at chrome://extensions.

Verify

pnpm -r test                                              # unit tests (vitest)
pnpm --filter @bokal/cookie-manager exec tsc --noEmit     # type-check
pnpm --filter @bokal/cookie-manager build                 # production build
pnpm --filter @bokal/cookie-manager zip                   # -> .output/*.zip (store upload)
pnpm --filter @bokal/cookie-manager e2e                   # Playwright E2E (smoke)

CI (.github/workflows/ci.yml) runs type-check, unit tests, build, and Playwright E2E against both the normal and E2E builds on every push and PR.

Guides

• EditThisCookie alternative — what happened to it, and migrating your JSON
• Bokal vs Cookie-Editor — the honest comparison
• Export cookies for Playwright — storageState how-to

Contributing & security

See CONTRIBUTING.md for the development workflow and the invariants that keep the trust posture true, and SECURITY.md to report a vulnerability.

License

GPL-3.0-or-later — see LICENSE. You are free to use, study, modify, and redistribute Bokal; derivative works must remain under the same license. Third-party dependency licenses are listed in THIRD-PARTY-NOTICES.md.