Cookie Extractor

A developer tool for inspecting and verifying session information.

Headless automation is increasingly blocked by 2FA QR codes, interactive

challenges, and anti-bot flows. This app takes the other road: you log in

by hand, exactly like in a normal browser, then one tap pulls the session

cookies for the loaded domain and hands them to the Android share sheet,

ready for curl, wget, or any script that needs an authenticated session.

What is inside:

- Address bar and in-app WebView; log in with password, 2FA, OTP, or most

SSO-redirect flows. Passkeys for third-party sites do not work in a

third-party WebView (Android privilege model); the README explains why.

- Non-http OAuth redirects are caught before an error page appears and

shared as one line, so relays cannot corrupt the authorization code.

- A share template with live preview shapes the shared text: placeholders

for payload, URL, title, host, and date, for example a ready-to-paste

curl command.

- Bookmarks with add-by-URL and entry-URL memory: what you typed, not

where the redirect landed.

- A session monitor: point it at a state document on your own gateway and

get a native notification when a login expires.

- An opt-in, token-gated debug channel with a versioned agent API

(/api/v1) to drive the app programmatically: navigate, read text and

cookies, fill and submit forms. Off by default; the README documents

every endpoint and the threat model.

It reads only the cookies of its own WebView through the public

CookieManager API: no root, no cross-app access, no automation of other