Morfiade
English
Try it

Why sessions from regular Chrome no longer transfer

A familiar situation: a new computer or a Windows reinstall — and every site asks you to log in again. Dozens of services, email and phone confirmations, a forgotten password here, lost access to the inbox that the code goes to there. It used to be fixed by copying the profile folder. Not anymore, and it's not your fault.

What changed

Starting with Chrome 127, the browser encrypts cookies in a new way — so-called App-Bound Encryption. Only Chrome itself can decrypt them, and only on the machine where the file originally lived. Copy the profile folder to another computer, and the cookies inside turn into unreadable garbage; on the very first launch Chrome cleans them out as corrupted. The size is all there, but there are no logins.

This was done against programs that stole sessions. The side effect is that an ordinary person can no longer move their own logins to a new computer by simple copying.

Google sync doesn't solve this

The logical response is to sign in to a Google account and let sync pull everything in. And it will — bookmarks, history, passwords. But not cookies. Sync doesn't carry site sessions at all — that's simply not something it does. So after signing in to the account on the new machine, you get your bookmarks back and log in to every site by hand all over again.

Easy to check: sign in to a Google account on a new computer and open any site you were logged into on the old one — it will ask you to log in. The bookmarks are already there, the sessions are not.

What you can actually do about it

The key is where you log in to the site. Cookies that Chrome has encrypted with its new method can't be taken with you. But cookies that were created from the start in a separate profile — can: they transfer in a readable form, not as an encrypted file.

That's exactly how Morfiade works. Each account lives in its own sandbox profile, and when you log in to a site inside such a profile, that session becomes transferable:

The difference is simple: you can no longer take a session out of regular Chrome, but a session created through Morfiade — you can, because from the very start it lives in a place it's allowed to be moved from.

What this looks like in practice

  1. Create a profile in Morfiade and log in to the sites you need inside it — a normal login, just once.
  2. Export profiles — the program packs a single file with the profiles, cookies, proxies, and your notes. The cookies in it are saved so they'll open on any machine.
  3. Move the file to another computer and do an Import — the profiles come back together with their sessions. Open the site and you're already logged in.

Storage and transfer are local: the file sits with you, not on someone else's server, and the process doesn't depend on any third-party cloud being available.

What about passwords and logins

Here everything comes down to one question: where they're stored — in the browser itself or in your Google account. That determines whether they travel or not.

We transfer cookies so they open on any machine — but Chrome encrypts passwords with a key tied to the Windows account. So you simply can't copy the password file to another computer: there's nothing there to decrypt it with. This applies both to passwords saved directly in the browser and to those stored in a Google account. There's a separate, reliable path for them — export as a file.

How to move them anyway

Chrome has its own file-based transfer, and it works exactly where the account is open:

On the old computer. Open chrome://password-manager/settings → "Export passwords". Chrome will ask you to confirm your Windows sign-in — that's expected, it's a built-in safeguard.

On the new computer. Same address → "Import passwords" → choose the file.

A nice side effect: after the import, the passwords become local. From then on they travel with the profile on their own, and you won't need to repeat this.

⚠️ The export file contains all your passwords in plain text. Delete it immediately after importing and don't leave it sitting in the "Downloads" folder.

We deliberately don't do this step for you and don't ask you to trust us with your passwords: the file should pass through your own hands and appear nowhere else. The program runs on your computer, and passwords are the one thing we consciously never touch at all.

The second lock, which almost nobody writes about

Encryption is only half of the restriction. The other half arrived in Chrome 136: the browser stopped honouring the --remote-debugging-port and --remote-debugging-pipe switches when it runs on the default profile folder. The debugging channel is now allowed only together with --user-data-dir pointing at a separate folder.

Why Google did it: through that channel a single command hands over every cookie in the profile — including the ones page scripts cannot reach. Once the new encryption closed off reading the files, sessions started being taken this way instead, so that door was shut too.

What it means in practice: even a program you trust and started yourself cannot take sessions out of your main Chrome. Not because it is incapable, but because the browser does not allow it — neither through files nor through debugging. If someone promises you otherwise, they are either talking about an old version of Chrome, or about something that has no business being on your computer.

And the same restriction explains why it does work with Morfiade profiles: they live in a separate folder — and a separate folder has its own encryption key and is allowed a debugging channel. The difference is not cleverness, it is where the profile sits from the very beginning.

Honest limits

So there are no false expectations:

In short

Chrome closed off session transfer on purpose, and Google sync doesn't carry sessions over — that can't be fixed. But if you log in to sites through Morfiade, sessions stay yours and transferable: between computers, after a system reinstall, and on several machines at once. Not "stop using Chrome," but stop logging in over and over.