How-to · Privacy
How to choose a cookie editor Chrome extension you can trust
La respuesta corta
A cookie editor reads your session cookies — which are your logins — so picking one is a security decision. Check four things: a minimal permission surface, open source with zero network access, a native Manifest V3 build, and full-field editing with JSON import/export. Here's the checklist, plus where our own editor stands.
- 1
List candidate editors and read each one's permissions before installing — cookie access is expected, but cookie access combined with network or all-pages script permissions is a red flag.
- 2
Verify the extension is open source and that the repository is public, so its handling of your cookies is auditable rather than taken on faith.
- 3
Confirm it makes no network requests and ships no analytics or telemetry — an editor that can't phone home can't leak cookies.
- 4
Check it's a native Manifest V3 build: the popup should update live when cookies change, not show stale data.
- 5
Test the essentials on a real site: inline editing of every field including HttpOnly and SameSite, search, and JSON export.
- 6
If you're migrating, import your old EditThisCookie JSON first to confirm the transition costs you nothing.
For a decade, "which cookie editor should I install?" had a one-word answer: EditThisCookie. That ended when Chrome's Manifest V3 migration swept the category — EditThisCookie was delisted in 2024, and the vacuum filled with lookalikes trading on its name and icon, some of which were later found injecting ads or doing things no cookie tool needs to do. Since a cookie editor by definition can read every session cookie in your browser, choosing a replacement is a trust decision, not a convenience one. Here is a concrete checklist. Full disclosure: we build CookieVault Editor, one of the tools measured against it — but the checklist is worth applying whichever editor you end up with.
Check the permission surface
Open the extension's details page before installing. Access to cookies and site data is expected — the tool can't work without it. What should give you pause is the combination of that access with anything else: background network permissions, remote-config fetching, or scripts injected into every page. The narrower the manifest, the smaller the blast radius if the extension is ever sold or compromised.
Prefer open source with zero network access
The decisive question is: can this code phone home? An editor that makes no network requests at all cannot exfiltrate your cookies, period. Open source makes that claim checkable instead of promotional — you (or anyone) can audit what the published code does with its cookie access, and confirm there's no analytics or telemetry SDK riding along.
Confirm it's MV3-native, not a patched port
Extensions hastily patched from Manifest V2 tend to break in the background: stale popups, missed cookie changes, features that silently stopped working. An MV3-native editor should feel reactive — if the site or another extension changes a cookie while the popup is open, the list should update on its own.
Test the features that made EditThisCookie useful
The baseline that made the original indispensable: every field editable inline (name, value, domain, path, expiry, and the SameSite / Secure / HttpOnly flags), search across domains, one-click delete, and JSON export. Two modern additions worth requiring: the ability to create and edit HttpOnly cookies (console tricks with document.cookie can't even see them) and import of your old EditThisCookie JSON, so migration is a drag-and-drop rather than a rebuild.
Where CookieVault Editor stands
CookieVault Editor is our attempt at passing this checklist cleanly: MV3-native, MIT-licensed open source, no network requests, no analytics, all data local. It edits every field including HttpOnly and partitioned (CHIPS) cookies, and imports both its own cookievault/v1 format and EditThisCookie's legacy export. The full workflow is covered in how to view and edit cookies in Chrome — and if your real goal is automatic cleanup rather than manual editing, that's the sibling extension's job: auto-delete cookies except a whitelist.