Bokal

A trustworthy, open-source cookie manager for Chrome (Manifest V3).
View, edit, add, delete, import, and export cookies — with nothing leaving your device.

---

Status: LIVE on the Chrome Web Store (published 2026-07-15). Chrome and Chromium browsers only. An Edge Add-ons submission is outstanding and unconfirmed — do not treat Bokal as available on Edge. See docs/HANDOFF.md for current state.

License: GPL-3.0-or-later. Bokal bundles ExtPay, which is copyleft (AGPL-3.0-or-later), so the combined work is conveyed under GPL-compatible terms — a permissive license like MIT would not be compliant. Reasoning in docs/licensing-notes.md; dependency licenses in THIRD-PARTY-NOTICES.md.

What Bokal is

Bokal is a Manifest V3 cookie manager built around a single promise: your cookies never leave your device. No server, no account, no telemetry, no analytics, no remote code. It reads and writes cookies through Chrome's cookies API and does everything locally.

It's aimed at web developers debugging sessions and auth, QA engineers juggling multiple accounts and login states, and privacy-conscious users who want to see and control what sites store.

Features (all free)

• Full cookie control — view, add, edit, and delete cookies, including HttpOnly cookies that UI-only tools can't touch.
• Search & filter, and view cookies for the current site or across all sites.
• Rules — protect cookies from deletion, pin important ones to the top, and block cookies from specific domains (reactive cleanup in the background service worker).
• Whitelist cleanup — keep a list of sites to preserve, then clear everything else with one click or an optional daily sweep (protected cookies are always kept).
• Cookie audit hints — flags missing SameSite, unpartitioned cross-site cookies, and oversized cookies inline.
• Export to JSON, Netscape (cookies.txt), cookie-header, and test-automation formats (Playwright storageState, Puppeteer) — no downloads permission needed.
• Import from JSON (Cookie-Editor / EditThisCookie compatible), cookie-header strings, and Playwright/Puppeteer files, validated before write.
• CHIPS partition inspector for modern partitioned cookies.
• DevTools panel — inspect and edit the current tab's cookies inside DevTools.
• Dark mode and virtualized lists that stay fast across thousands of cookies.

Bokal Pro (optional, paid)

Pro adds named local cookie profiles — snapshot a site's cookies and switch between saved sets (e.g. different test accounts) in one click — with optional passphrase encryption (AES-GCM + PBKDF2, 600k iterations). Profiles live only on your device in IndexedDB.

Pro is deliberately minimal on privacy impact:

• The Pro UI is code-split into a separate lazy chunk — it loads via dynamic import() only when you're entitled, and the main bundle contains no Pro logic, so a free user never fetches or runs it. (The chunk ships inside the package like any code-split app; it's simply never loaded unless you buy Pro.)
• Free users make zero network calls. Billing (via ExtPay → Stripe) is only ever contacted after you open the upgrade page. See docs/pro-monetization.md.

How Bokal compares

Being straight about this, because the obvious comparison is Cookie-Editor (~2M users) and half of what you'd expect to separate them doesn't. Cookie-Editor is also GPL-3.0, also Manifest V3 (since 2022), and has also used optional_host_permissions rather than install-time site access since August 2023. So "open source" and "no install-time host permissions" are not reasons to prefer Bokal.

What actually differs (verified against its published manifest.chrome.json, 2026-08-26):

	Bokal	Cookie-Editor
tabs permission	not requested (uses activeTab)	requested
"Read your browsing history" at install	no	yes — consequence of tabs
Install-time site access	none (optional grant)	none (optional grant)
License	GPL-3.0	GPL-3.0
CHIPS partitioned cookies	partition inspector	no partitionKey handling
Playwright storageState export	yes	no
Puppeteer setCookie export	yes	no
Users / track record	small, launched 2026	~2M, 4.4★
Browsers	Chrome / Chromium	Chrome, Edge, Firefox, Opera, Safari

If you don't work with partitioned cookies or test automation and the browsing-history permission doesn't bother you, Cookie-Editor is a good tool and you should use it. Longer write-up: bokal.dev/cookie-editor-alternative.

Trust posture

Every privacy claim here is meant to be literally true against the code — that's the product.

• No tabs permission — so no "read your browsing history" warning at install. (No install-time host_permissions either, though as noted above that part is not unique.) Host access is optional_host_permissions: ['<all_urls>'], requested at runtime for the specific site you're managing (via activeTab to read the current URL), and only escalated to all-sites when you explicitly open the all-cookies view, export all sites, or run cleanup.
• No remote code — everything Bokal runs is in the published package.
• Cookie values are never logged, and render as text nodes only (an XSS regression test locks this). Enforced by redaction.test.ts in CI.
• The published manifest is: cookies, storage, sidePanel, unlimitedStorage, alarms, activeTab + optional <all_urls>.

Context: the permission landscape backs a minimal-permission stance — a peer-reviewed 2022 study found only ~39.8% of Chrome Web Store extensions comply with the spirit of least privilege. Bokal's threat model is documented in docs/threat-model.md.

Repository layout

This is a pnpm monorepo.

apps/cookie-manager/   # the WXT + React + TypeScript extension (the product)
  entrypoints/         #   background.ts (service worker), sidepanel/ (App.tsx), devtools
  lib/                 #   cookies/, io/, pay/, profiles/, rules/, security/, permissions, ...
  stores/              #   zustand stores (cookies, entitlement, rules, profiles)
  components/          #   CookieRow/List/Editor, IoBar, SearchBar, pro/ProfilesPanel (lazy)
  e2e/                 #   Playwright fixtures + smoke/granted specs
packages/ui-kit/       # shared theme.css + useTheme
packages/tsconfig/     # shared TS config
site/                  # landing page + hosted privacy policy (static)
docs/                  # HANDOFF, threat-model, pro-monetization, store/, business/, specs

Getting started

Requires Node ≥ 24 and pnpm 9.9.0 (corepack enable will provide pnpm).

pnpm install
pnpm --filter @bokal/cookie-manager dev      # WXT dev server
pnpm --filter @bokal/cookie-manager build     # -> apps/cookie-manager/.output/chrome-mv3

Load apps/cookie-manager/.output/chrome-mv3 as an unpacked extension at chrome://extensions.

Verify

pnpm -r test                                              # unit tests (vitest)
pnpm --filter @bokal/cookie-manager exec tsc --noEmit     # type-check
pnpm --filter @bokal/cookie-manager build                 # production build
pnpm --filter @bokal/cookie-manager zip                   # -> .output/*.zip (store upload)
pnpm --filter @bokal/cookie-manager e2e                   # Playwright E2E (smoke)

CI (.github/workflows/ci.yml) runs type-check, unit tests, build, and Playwright E2E against both the normal and E2E builds on every push and PR.

Guides

• EditThisCookie alternative — what happened to it, and migrating your JSON
• Bokal vs Cookie-Editor — the honest comparison
• Export cookies for Playwright — storageState how-to

Contributing & security

See CONTRIBUTING.md for the development workflow and the invariants that keep the trust posture true, and SECURITY.md to report a vulnerability.

License

GPL-3.0-or-later — see LICENSE. You are free to use, study, modify, and redistribute Bokal; derivative works must remain under the same license. Third-party dependency licenses are listed in THIRD-PARTY-NOTICES.md.