From c595ff5511fca1f964ad935a763ab7f70b96dae9 Mon Sep 17 00:00:00 2001
From: tiennm99 <tiennm99@outlook.com>
Date: Mon, 11 May 2026 21:42:43 +0700
Subject: [PATCH] docs(readme): add output format, Chrome v10+ encryption
 details

---
 export-chrome-cookies/README.md | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/export-chrome-cookies/README.md b/export-chrome-cookies/README.md
index 1c919cd..e8e5001 100644
--- a/export-chrome-cookies/README.md
+++ b/export-chrome-cookies/README.md
@@ -9,7 +9,34 @@ pip install -r requirements.txt
 python main.py
 ```
 
-> **Note:** Run on Windows with Chrome closed. Exports cookies to a local file.
+> **Note:** Run on Windows with Chrome fully closed. Chrome locks its SQLite cookie database while running.
+
+## Output format
+
+Cookies are written to `cookies.json` in the current directory. Each entry follows the WebExtension cookie schema:
+
+```json
+{
+  "domain": ".example.com",
+  "name": "session_id",
+  "value": "abc123",
+  "path": "/",
+  "secure": true,
+  "httpOnly": false,
+  "sameSite": "lax",
+  "expirationDate": 1735689600,
+  "session": false
+}
+```
+
+## Chrome v10+ encryption
+
+Chrome 80+ on Windows encrypts cookie values using AES-256-GCM with a key stored in `Local State` (protected by DPAPI). The script:
+1. Reads the base64-encoded encrypted key from `AppData\Local\Google\Chrome\User Data\Local State`.
+2. Decrypts it with `win32crypt.CryptUnprotectData`.
+3. Uses the key to decrypt each cookie value from the `Cookies` SQLite database.
+
+You must run the script **as the same Windows user** who owns the Chrome profile — DPAPI keys are user-scoped.
 
 ## License