125

I need to get all the cookies stored in my browser using JavaScript. How can it be done?

5
  • 6
    nayagi, unfortunately if we do answer your question you would have software that is nothing less than MALWARE.
    – Jon Limjap
    Oct 31, 2008 at 6:32
  • 21
    @Jon Limjap - that's not quite true. There are legitimate scenarios for being able to enumerate through all cookies in a web browser without being malware. Oct 31, 2008 at 18:47
  • Whoa wait a sec. All of the cookies? Login's from any website? That's malware...
    – alexyorke
    Apr 7, 2011 at 19:34
  • I have a situation (web apps behind the firewall for a business) where doing this would be handy and quite legitimate. However, the issue exists because we have too many internal domains (mostly through virtual hosts) so one could argue that the solution is to use Single Sign On.
    – ClubbedAce
    Jan 14, 2014 at 21:12
  • If you truly need all cookies, you have to create and install a browser extension to do that. Cookies used for logins are considered sensitive and browsers do their best to keep those secret. Sep 3, 2020 at 15:54

9 Answers 9

107

You can only access cookies for a specific site. Using document.cookie you will get a list of escaped key=value pairs seperated by a semicolon.

secret=do%20not%20tell%you;last_visit=1225445171794

To simplify the access, you have to parse the string and unescape all entries:

var getCookies = function(){
  var pairs = document.cookie.split(";");
  var cookies = {};
  for (var i=0; i<pairs.length; i++){
    var pair = pairs[i].split("=");
    cookies[(pair[0]+'').trim()] = unescape(pair.slice(1).join('='));
  }
  return cookies;
}

So you might later write:

var myCookies = getCookies();
alert(myCookies.secret); // "do not tell you"
3
  • 5
    this doesnt catch the space after the semicolon ("; ") so keys have a space at the front... use /; ?/ when splitting to remove them? Dec 20, 2011 at 21:43
  • Check this snippet out for parsing document.cookies (from O'Reilly book).
    – Bentley4
    Nov 4, 2013 at 10:42
  • should really add .trim() to pair[0] to make sure that there is no leading spaces. Jul 15, 2016 at 19:53
58
  1. You can't see cookies for other sites.
  2. You can't see HttpOnly cookies.
  3. All the cookies you can see are in the document.cookie property, which contains a semicolon separated list of name=value pairs.
37

You cannot. By design, for security purpose, you can access only the cookies set by your site. StackOverflow can't see the cookies set by UserVoice nor those set by Amazon.

6
  • 6
    how did facebook doing that...? I always saw facebook shows ads related to what I browsed from google!
    – Ari
    Apr 8, 2015 at 13:02
  • 19
    Actually, Facebook plants its own cookies on every site... using its Like button. I bet Google do the same on the +1 buttons or even on the site stats scripts.
    – PhiLho
    Apr 9, 2015 at 8:43
  • 1
    thank you..., it's opening my eyes. I think any kind of app related to them will do, including login using social media account app.
    – Ari
    Apr 10, 2015 at 2:29
  • 2
    @SoursopTree - Isn't it AdChoices? Facebook uses AdChoices, which is a Google service that displays content based on your searches through Google. Stackoverflow uses AdChoices too. I may be a bit off on the exact details - but I'd guess that's what it is you're thinking of.
    – Rik
    Oct 23, 2015 at 8:24
  • 1
    @KeepMove we call this terminology as cookie-syncing
    – ericdemo07
    May 18, 2017 at 7:56
13

To retrieve all cookies for the current document open in the browser, you again use the document.cookie property.

4

Modern approach.

let c = document.cookie.split(";").reduce( (ac, cv, i) => Object.assign(ac, {[cv.split('=')[0]]: cv.split('=')[1]}), {});

console.log(c);

;)

2
  • It seems it generates an space before each key. Example: " cookie_name" instead of "cookie_name"
    – jobima
    Nov 9, 2020 at 12:08
  • 1
    Solved adding trim: return document.cookie.split(";").reduce( (ac, cv, i) => Object.assign(ac, {[cv.split('=')[0].trim()]: cv.split('=')[1]}), {});
    – jobima
    Nov 9, 2020 at 12:13
3

Since the title didn't specify that it has to be programmatic I'll assume that it was a genuine debugging/privacy management issue and solution is browser dependent and requires a browser with built in detailed cookie management toll and/or a debugging module or a plug-in/extension. I'm going to list one and ask other people to write up on browsers they know in detail and please be precise with versions.

Chromium, Iron build (SRWare Iron 4.0.280)

The wrench(tool) menu: Options / Under The Hood / [Show cookies and website permissions] For related domains/sites type the suffix into the search box (like .foo.tv). Caveat: when you have a node (site or cookie) click-highlighted only use [Remove] to kill specific subtrees. Using [Remove All] will still delete cookies for all sites selected by search and waste your debugging session.

3

Added trim() to the key in object, and name it str, so it would be more clear that we are dealing with string here.

export const getAllCookies = () => document.cookie.split(';').reduce((ac, str) => Object.assign(ac, {[str.split('=')[0].trim()]: str.split('=')[1]}), {});
1

If you develop browser extensions you can try browser.cookies.getAll()

1
0

What you are asking is possible; but that will only work on a specific browser. You have to develop a browser extension app to achieve this. You can read more about chrome api to understand better. https://developer.chrome.com/extensions/cookies