Project Overview
Chromepass is an offensive-security utility whose job is narrow and blunt: pull saved passwords out of Google Chrome and decrypt them. If you do authorized red-team work, build detections, or just want to understand how much your browser trusts the local machine, this is the kind of tool you study.
Treat it as a demonstration of a credential-access technique, not a product you deploy. It targets Chrome's local credential store, reads the encrypted blobs, and uses the operating system's own key material to turn them back into plaintext. That is the whole point: Chrome's saved-password security model assumes the local user account is trusted, and Chromepass shows you exactly what an attacker (or you, with permission) can do once that assumption holds.
This is a focused, single-purpose project. It is not a framework, it does not manage engagements, and it will not hold your hand. Because it sits in the offensive-tooling space, expect the maintenance cadence and documentation depth to vary — check the commit history and open issues before you rely on it, since security tools like this break whenever Chrome changes its storage format.
Use it only against systems you own or are explicitly authorized to test. Extracting credentials from a machine you do not control is a crime in most jurisdictions, full stop.
Key Challenges Addressed
The real problem Chromepass illustrates is that "saved in the browser" is not the same as "safe." Specific challenges it targets:
- **Local credential exposure.** Chrome stores passwords encrypted, but the decryption key lives on the same machine, protected by the OS user context. Chromepass demonstrates that any code running as that user can recover the plaintext. The defensive lesson: a compromised endpoint means compromised saved passwords.
- **Detection and response testing.** If you run a blue team, you need to know whether your EDR flags credential reads from the Chrome profile directory. Running a known tool like this in a lab is how you generate the telemetry to tune those detections.
- **Password-hygiene reality checks.** It makes concrete the argument for a dedicated password manager with a master secret, rather than relying on the browser's built-in store.
The mechanism is straightforward: locate the Chrome user-data directory, read the credential store, obtain the per-user encryption key from the OS-protected storage, and decrypt.
Features and Use Cases
What you can realistically do with it:
- **Authorized post-exploitation demonstrations.** On an engagement where you already have user-level code execution, show the client what "saved passwords" actually means in terms of risk.
- **Detection engineering.** Use it as a repeatable source of credential-access activity to validate that your monitoring catches reads of the Chrome login data store.
- **Security education.** Teach developers and users why browser-saved credentials are only as strong as the endpoint they sit on.
Do not use it for phishing follow-up, lateral movement against third parties, or anything outside a written scope. The tool does not know or care about your authorization — that responsibility is entirely yours.
Ecosystem and Dependencies
Tools in this category live alongside broader credential-recovery and post-exploitation suites. If you are building a lab or a detection corpus, you will likely pair a focused extractor like Chromepass with general-purpose tools such as LaZagne for multi-application credential recovery, or browser-data extractors like HackBrowserData that cover cookies, history, and bookmarks in addition to passwords.
The dependency you cannot escape is the host OS itself. Because decryption relies on operating-system key-protection APIs, the tool is tightly coupled to platform internals and to Chrome's current storage format. When Chrome ships a new encryption scheme, expect breakage until the tool is updated.
Architectural Overview
The design splits into a few clear responsibilities:
- **Locator.** Finds the Chrome profile and its credential database on disk.
- **Reader.** Opens and parses the stored credential records.
- **Decryptor.** Pulls the user-scoped key from OS-protected storage and reverses the encryption on each record.
- **Output.** Renders recovered credentials for the operator.
Why this matters to you: the decryptor is the fragile, platform-specific part. Everything else is comparatively stable file and database handling. When you debug a failure, start at the key-retrieval step, because that is where OS and Chrome version changes bite first.
Pros and Cons
- Does one thing and makes a single security concept very concrete.
- Useful for authorized testing, detection tuning, and education.
- Small surface area, so it is readable and easy to audit before you run it.
- Tightly coupled to Chrome internals; breaks when the storage format changes.
- Narrow scope — no engagement management, no multi-app coverage.
- Maintenance and platform support vary; verify the project is current before depending on it.
- High misuse potential, which means you carry full legal and ethical responsibility.
Comparison and Alternatives
GitHub stars
Weekly star gains
Full metrics details
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
Chromepass
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub GraphQL current stargazer cohort, reconstructed from starredAt events and totalCount retrieved in one stable pagination walk. GitHub does not expose historical unstar events, so this is not an exact ledger of past star counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Issues opened
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Chromepass
GitHub API observation. Historical values render only when the source provides a real observation for that day.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub API observation. Historical values render only when the source provides a real observation for that day.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Issues closed
Weekly total
Full metrics details
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
Chromepass
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests opened
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Chromepass
GitHub API observation. Historical values render only when the source provides a real observation for that day.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub API observation. Historical values render only when the source provides a real observation for that day.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests closed
Weekly total
Full metrics details
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
Chromepass
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Pull requests merged
Weekly total
Full metrics details
GitHub API observation. Historical values render only when the source provides a real observation for that day.
Chromepass
GitHub API observation. Historical values render only when the source provides a real observation for that day.
131 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub API observation. Historical values render only when the source provides a real observation for that day.
177 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Open/closed pull request ratio
Weekly average
Full metrics details
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
Chromepass
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub Search pull-request totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Open/closed issues ratio
Weekly average
Full metrics details
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
Chromepass
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub Search issue totals queried for exact UTC days; rolling values are sums of proven daily counts.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Releases
Weekly total
Full metrics details
GitHub release published_at events bucketed by UTC day; drafts are excluded.
Chromepass
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
HackBrowserData
GitHub release published_at events bucketed by UTC day; drafts are excluded.
180 observed daily rows. Missing days are not fabricated.
| Date | Value |
|---|
Hotness score
Weekly average
Full metrics details
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
Chromepass
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
HackBrowserData
Derived only from GitHub GraphQL starredAt events after daily star totals are reconciled.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.40 × Hot today + 0.40 × Hot week + 0.20 × Breakout.
- Same-day multiplier = stars 1d ÷ max(1, stars 7d ÷ 7)
- Weekly multiplier = stars 7d ÷ max(1, stars 30d ÷ 30 × 7)
- Fortnight multiplier = stars 14d ÷ max(1, stars 90d ÷ 90 × 14)
- Hot today = clamp(70 × log-scale(stars 1d, 1000) + 30 × breakout-scale(same-day, 4))
- Hot week = clamp(75 × log-scale(stars 7d, 5000) + 25 × breakout-scale(weekly, 3))
- Breakout = clamp(35 × breakout-scale(same-day, 4) + 40 × breakout-scale(weekly, 3) + 25 × breakout-scale(fortnight, 2.5))
| Date | Stars | Stars 1d | Stars 7d | Stars 14d | Stars 30d | Stars 90d | Same-day multiplier | Weekly multiplier | Fortnight multiplier | Hot today | Hot week | Breakout | Stored score |
|---|
Reliability score
Weekly average
Full metrics details
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
Chromepass
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
HackBrowserData
Derived from the displayed continuity, closure, shipping, liveness, and support-burden components.
180 observed daily rows. Missing days are not fabricated.
Per-day formula: 0.30 × Continuity + 0.30 × Closure + 0.20 × Shipping + 0.10 × Liveness + 0.10 × Support burden.
- Continuity = 35% active ratio 90d + 20% active ratio 30d + 15% PR efficiency 90d + 10% PR efficiency 30d + 10% liveness + 10% observed-history coverage
- Closure = 55% PR merge efficiency 90d + 45% issue close efficiency 90d
- Shipping = 100 × (20% × release ratio 30d + 30% × release ratio 90d + 50% × release ratio 180d); ratios are releases ÷ 2, 6, and 12, capped at 1
- Support burden = 100 − 2 × open issues per 1,000 stars
- Liveness = 100 × exp(−pushed days ago ÷ 120)
Stars, issues, pull requests, and releases are daily observations. Pushed-days and license are repository snapshot-derived inputs and are not independent historical GitHub events.
| Date | Issues opened | Issues closed | PRs opened | PRs merged | Releases | Stars | Open issues | Pushed days ago | Continuity | Closure | Shipping | Liveness | Support burden | License | Observed days | Missing days | Needs healing | Stored score |
|---|
If your need is broader than "Chrome passwords only," several mature, well-known tools cover adjacent or overlapping ground.
For most teams, the best overall alternative is LaZagne: it covers credential recovery across many applications rather than Chrome alone, has a long track record, and is the more widely referenced tool in security curricula.
If you are a red-teamer or detection engineer who needs a concrete, auditable demonstration of how Chrome's saved-password store falls to local code execution, Chromepass is worth your time — read the source and the issues on the before you run anything. Its narrow scope is a feature here: a small tool you can fully understand beats a large suite you cannot.
Do not point this at a machine you are not authorized to test — credential extraction without written permission is a crime, and the tool will happily decrypt whatever it can reach. Do this first: stand up a throwaAC, log into Chrome with junk credentials in an isolated lab VM, and run it there while your monitoring watches.