Storage Inspector — Cookies, localStorage & IndexedDB Viewer

See everything a website has stored in your browser — in one readable place. Storage Inspector shows you cookies, localStorage, sessionStorage, IndexedDB, Cache Storage and service workers side by side, with sizes, expiry dates and security flags laid out clearly. Then it analyses what it finds and tells you what is wrong. Free. No account. No server. Nothing ever leaves your browser. WHAT YOU SEE • Cookies — value, domain, path, size, expiry (absolute and relative) and every flag: Secure, HttpOnly, SameSite, partitioned. Including HttpOnly cookies, which document.cookie deliberately hides from page scripts. • localStorage and sessionStorage — every key with its size and detected type, decoded: JSON is pretty-printed, JWTs have their claims read out, base64 and URL-encoded values are unwrapped. • IndexedDB — every database, version, object store, key path, index, record count and the records themselves. • Cache Storage — every cache, every cached request, its status, content type and size. • Service Workers — scope, script URL and the state of the active, waiting and installing worker. THE ANALYSER A 0–100 storage health score, built from concrete rules — not a model, not a guess. Every finding names what it checked, shows the evidence, and suggests a fix. Security — cookies missing Secure on an HTTPS page, session tokens readable by JavaScript because HttpOnly is missing, SameSite=None without Secure (which browsers silently reject), missing SameSite, credential-shaped keys sitting in localStorage, JWTs with no expiry claim, JWTs signed with alg: none. Privacy — cookies and keys left behind by analytics, advertising and session-recording services, matched against a built-in catalogue covering more than 40 of them, with each finding naming the service it belongs to. Plus third-party cookie domains, and email addresses stored in plain text. Size — the 4 KB per-cookie limit, total cookie weight carried on every single request, localStorage and sessionStorage quota pressure, origin quota usage, and values large enough to block the main thread. Expiry — expired cookies still sitting there, cookies expiring within 24 hours, expiry beyond Chrome's 400-day cap, session cookies, and expired or soon-to-expire JWTs. Hygiene — the same value duplicated across keys, stringified bugs like "undefined" and "[object Object]", service worker updates stuck waiting to activate, and leftover versioned caches your service worker forgot to delete. ALSO INCLUDED • Search across keys and values, with one-click filters for insecure cookies, trackers, JWTs, credential-shaped keys and oversized values. • Edit values live — a cookie's value and its Secure, HttpOnly, SameSite and expiry flags; any localStorage or sessionStorage key, including brand new ones; an IndexedDB record as JSON. Every write shows the current and new value side by side before it is applied. • Delete anything — individual cookies and keys, whole IndexedDB databases, caches, single cache entries, or service worker registrations — behind a two-step confirmation that names the real consequences, and asks you to type DELETE for the riskiest selections. • Sizes on everything, a largest-keys ranking, and quota meters. • Live mode that re-reads storage as the page changes. • Export a full JSON snapshot, a value-redacted JSON snapshot safe to share, a CSV, or a Markdown analysis report. All generated locally. • Keyboard shortcuts: / to search, R to rescan, Esc to close, Alt+Shift+S to open. WHO IT IS FOR Web developers debugging why a session drops or a cache will not clear. Security engineers auditing cookie flags and token storage. QA testers who need a reproducible record of what a site stores. Privacy researchers documenting tracking. Anyone curious about what a website is keeping on their machine. PRIVACY Storage Inspector has no server, no analytics, no telemetry and no network code at all. It never makes a request anywhere. It ships every line it runs — no remote code. What it reads is shown to you and discarded when you close it. It installs with access to no sites at all. Clicking the toolbar icon lets it read the tab you are on, and cookies ask for that one site's permission the first time you look at them. You can allow all sites instead if you would rather not be asked, and take any of it back from Chrome at any time. Full policy: https://glitchbong.com/tools/storage-inspector#privacy MORE Documentation, the full list of analyser rules, and the FAQ: https://glitchbong.com/tools/storage-inspector Other free developer tools, no sign-up on any of them: https://glitchbong.com/tools MIT licensed.