CookieTin Extension Manages Partitioned Cookies Across Firefox, Chrome and Edge

Developer Perruer2 has released CookieTin, an open-source browser extension that fully supports partitioned cookies under Firefox Total Cookie Protection and Chrome CHIPS. The tool addresses limitations in older managers like Cookie Quick Manager by correctly retrieving and deleting cookies stored with partitionKey values. It works across Firefox, Chrome and Edge using a single Manifest V3 codebase written in TypeScript and Preact. Key features include accurate cookies.txt export compatible with curl and yt-dlp, protected cookies that survive explicit deletion, and pre-save validation of browser rules for __Host- prefixes and SameSite attributes. E2E tests using Puppeteer verify handling of HttpOnly, partitioned and container cookies in all three browsers.

HabrTranslated from Russian

Read at source

Modern browsers isolate cookies to prevent cross-site tracking, yet many cookie managers still miss a growing category of these isolated entries. Partitioned cookies appear when Firefox enables Total Cookie Protection by default or when sites mark cookies with the Partitioned attribute under Chrome’s CHIPS proposal.

In both cases the WebExtensions API returns an extra partitionKey object containing the top-level site. Without explicitly passing an empty partitionKey to cookies.getAll(), these entries simply do not appear in results, and the same problem affects cookies.remove().

CookieTin solves the issue with a unified retrieval function that first tries the partitioned query, falls back gracefully on older Chromium builds, and also sets firstPartyDomain: null on Firefox to surface First-Party Isolation cookies. The extension’s uniqueness key therefore includes storeId, domain, path, name, firstPartyDomain and the full partitionKey tuple.

When editing cookies the extension enforces several browser-specific rules before calling cookies.set(). Host-only cookies must omit the domain field entirely; otherwise the browser creates a wildcard entry for subdomains. Firefox rejects the value “unspecified” for sameSite, so the field is simply omitted. Cookies carrying the __Host- prefix, SameSite=None without Secure, or an expiration date in the past are rejected with a human-readable explanation.

Export to the classic cookies.txt format now correctly distinguishes TRUE/FALSE from the lowercase true/false produced by the old Cookie Quick Manager. The importer recognises both variants by case so that yt-dlp and similar tools receive accurate files.

Protected cookies receive special treatment: an onChanged listener restores them if they are removed with cause “explicit”. The listener deliberately ignores expired or overwritten cookies. All functionality is delivered in a single Manifest V3 codebase that runs on Firefox (including Android), Chrome and Edge, with browser-specific storage identifiers and alarm scheduling hidden behind abstraction layers.

Comprehensive Puppeteer-based E2E tests create ordinary, HttpOnly and partitioned cookies, open the manager UI, and verify listing, deletion, editing and round-trip export/import. An additional upgrade test installs the last public release of Cookie Quick Manager, adds protected cookies, then updates to CookieTin and confirms settings migration.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately
Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026
WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers