Cookie Extractor

about

description

A developer tool for inspecting and verifying session information. Headless automation is increasingly blocked by 2FA QR codes, interactive challenges, and anti-bot flows. This app takes the other road: you log in by hand, exactly like in a normal browser, then one tap pulls the session cookies for the loaded domain and hands them to the Android share sheet, ready for curl, wget, or any script that needs an authenticated session. What is inside: - Address bar and in-app WebView; log in with password, 2FA, OTP, or most SSO-redirect flows. Passkeys for third-party sites do not work in a third-party WebView (Android privilege model); the README explains why. - Non-http OAuth redirects are caught before an error page appears and shared as one line, so relays cannot corrupt the authorization code. - A share template with live preview shapes the shared text: placeholders for payload, URL, title, host, and date, for example a ready-to-paste curl command. - Bookmarks with add-by-URL and entry-URL memory: what you typed, not where the redirect landed. - A session monitor: point it at a state document on your own gateway and get a native notification when a login expires. - An opt-in, token-gated debug channel with a versioned agent API (/api/v1) to drive the app programmatically: navigate, read text and cookies, fill and submit forms. Off by default; the README documents every endpoint and the threat model. It reads only the cookies of its own WebView through the public CookieManager API: no root, no cross-app access, no automation of other apps. Extracted cookies are session credentials; share them only over channels you trust. Licensed under the Apache License 2.0.

publisher

78ce6faa72264387284e647ba6938995735ec8c7d5c5a65737e55130f026307d

first seen

2026-10-04T20:36:44.819845+00:00

last event

2026-10-04 20:36 UTC

install

zapstore.dev or any Zapstore-compatible client

topics

#development

source & build

repository

https://github.com/paoloantinori/cookies-extractor

arch flags

android-arm64-v8a android-armeabi-v7a android-x86 android-x86_64

manifest

missing

releases (kind 30063)

1 release indexed; latest 1.1.0.

assets & verification

Every app, release and asset event is schnorr-verified (NIP-01 id + signature) before it enters the catalog, and assets are content-addressed by sha256. We subscribe read-only to the catalog relay — never write to it.

1.1.0 — com.cookiesextractor.app_3.apk

sha256

baa7f8e80d1f6481c0922f14b58df2c5056ba220a84d5b76cbfaa94efb3635da

size

4.6 MB

archs

android-arm64-v8a, android-armeabi-v7a, android-x86, android-x86_64

version code

3

apk cert sha256

ff0caf02db435a9e973744ffbabd4be24a694c1395f6632063d7bf849d7cc570

download

com.cookiesextractor.app_3.apk

Showing the newest 1 asset descriptor; the full set is in /api/apps/78ce6faa…