App-Bound Encryption
App-Bound Encryption is the encryption method Chrome has used to protect cookies since version 127. The key is tied not to the file but to the browser itself and to the machine: only Chrome, and only on the machine where the cookies originally lived, can decrypt them.
Such entries are easy to spot by the start of the value — v20 instead of the earlier v10.
What changed for an ordinary person
A Chrome profile used to move by copying the folder. Now it doesn't: copied cookies on another computer turn into unreadable garbage, and on the first launch Chrome clears them out as corrupted. The size is all there, but there are no logins.
Our measurement on a live profile:
| What we checked | Result |
|---|---|
| main profile's cookies | 2618 of them, all v20 |
| the same folder, copied elsewhere | 0 of 2618 read |
| cookies of profiles created in a separate folder | all v10 — ordinary |
The second lock: debugging
Encryption is only half of it. With Chrome 136, the browser stopped accepting debugging keys (--remote-debugging-port, --remote-debugging-pipe) when it runs on the default profile folder. Previously, a single command over the debugging channel handed over the whole profile's cookies at once — session-stealing programs used exactly that, and the door got closed.
Both restrictions appeared against session theft, and both apply to everyone equally.
What follows from this
No one can take sessions from your main Chrome — not through files, not through debugging. If you're promised otherwise, it's either an old Chrome version, or a program that has no business being on your computer.
Meanwhile, bookmarks, history, autofill and extensions still move over normally, and passwords move as a separate step, through Chrome's own built-in export to a file.
Why separate profiles are different
A non-default profile folder has a different encryption key — this is stated in Google's own announcement. Because of that, cookies in such a profile stay ordinary (v10) and can be moved, and debugging is allowed in it.
Which gives a practical rule about order of operations: a session doesn't become transferable retroactively — it becomes transferable from the moment you started it in a separate profile. A full breakdown — in the article on transferring sessions.