Aar318's Session Vault

Aar318's Session Vault

Save multiple named login sessions for a website and load them from one compact toolbar vault. Session Vault is designed for people who regularly move among personal, work, family, test, or media-service accounts without maintaining a separate browser profile for every account.

Getting Started

1. Pin Session Vault to the browser toolbar.
2. Open a supported website and sign in to an account.
3. Select Session Vault, choose Save current, and name the profile.
4. Use Re-auth to clear the current session locally, sign in to another account, and save it as another profile. Avoid the site's own Sign out command because it may revoke the saved token server-side.
5. Select Load on a saved profile. The current site session is replaced and the tab reloads.

• Multiple Profiles Per Site: Save, name, annotate, color-label, update, rename, export, and delete multiple sessions for each website origin.
• Complete Session Capture: Capture cookies, including HttpOnly cookies, plus selected localStorage and sessionStorage data.
• Fast Account Switching: Replace the active site's cookies and selected web storage, then reload to apply the chosen profile.
• Safe Re-authentication: Clear the site's local session without invoking its normal sign-out flow, then reload and sign in again when adding another account.
• Manual-Only Profiles: Every completed capture creates exactly one profile. Loading and re-authentication never create automatic profiles or backups.
• Global Session Manager: Use a grouped, collapsible All Sites overview with search, alphabetical website groups, and favorites-first sorting within each site to manage sessions from every saved website.
• Clean Transfer Workflows: Automatically preview profile names, websites, site count, profile count, estimated size, and encryption status before export. Imports restore valid included preferences and automatically show a restore preview before a single Import click changes the vault.
• Verified Encrypted Backups: Export one profile, the current site, the active profile, or the complete vault. All Sites exports refresh directly from current vault storage, verify every selected profile, and decrypt protected output in memory before downloading. Exports use unique timestamps and offer AES-GCM protection with a four-character passphrase or PIN minimum.
• Password Tools: Generate ambiguity-free random characters or memorable real-word combinations, then preview, refresh, reveal, copy, and apply the result with clear password controls.
• Controlled Import: See exactly which profiles will be added, updated, or skipped before restoring, with origin, cookie, schema, and size validation plus visible success or failure feedback.
• Duplicate Protection: Optionally prevent exact duplicate captures and skip duplicate sessions during normal restore. Choose Overwrite existing IDs to replace same-origin matches, or Always add as new to keep copies.
• Optional Timed Vault Lock: Encrypt saved profile records at rest and require the master password to unlock the vault temporarily. Choose a 15-minute, 30-minute, 1-hour, 4-hour, or 8-hour timer; one hour is the default. Each protected export can use the unlocked master password without displaying or exposing it, or use a separate generated/custom password instead.
• Safer Changes: Load confirmations are enabled by default and can be replaced with optional One-click Load. Separate confirmations protect overwrites and other destructive actions. Imported and restored profiles remain locked to their exact website origin.
• Complete Settings Tools: Export, import, reset, or clear settings separately from saved profiles.
• Personalized Interface: Choose dark, light, or system appearance plus Emerald, Blue, Purple, Amber, or Rose accents.
• Accessible Controls and Shortcuts: Use the toolbar action, Alt+Shift+V, or right-click commands for opening, saving, re-authentication, Ko-fi, and Donate. Responsive, keyboard-accessible controls include explanatory tooltips, a fully visible title with the active website shown compactly on its right, and consistent project-icon branding throughout Profiles, Settings, and About.

• Imported sessions remain available after closing and reopening the vault.
• Delete all profiles clears saved sessions and resets the All sites count, allowing clean reimports.
• Previously hidden saved sessions are recovered into the profile list, and missing entries no longer inflate counts.
• Import previews appear automatically after selecting a backup and entering its passphrase. Review the result and select Import once.
• Added Overwrite existing IDs alongside Update existing IDs and Always add as new. Explicit overwrite and copy choices bypass duplicate-session skipping.
• All sites groups are sorted alphabetically.
• Export previews automatically list the included profile names and websites alongside the backup summary.

• Cookies: Reads, creates, and removes cookies only to capture, restore, or clear sessions at your request.
• Website Access: Allows session work on the website open in the active tab and supports cookies belonging to that site.
• Scripting: Reads and restores localStorage and sessionStorage in the active tab after the user opens or invokes the extension.
• Storage: Keeps settings and saved session profiles inside the local browser profile.
• Context Menus: Adds user-invoked toolbar-menu shortcuts and support links.

Session Vault has no analytics, advertising, telemetry, remote code, or automatic network service. Vault data remains in the local browser profile unless you explicitly export it. Ko-fi and Donate open only when selected.

Saved sessions are credentials: anyone with access to them may gain access to the associated accounts. Optional master-password protection encrypts saved profile records at rest and relocks the vault after the configured timer; index metadata and settings remain visible. Without it, extension storage is not passphrase-encrypted at rest. Profile exports offer AES-GCM protection and enable it by default; treat every unencrypted export like a password.

• Privacy policy: https://gist.github.com/aar318/9d4fc167a12546f162bcef3b91322aad

Session Vault captures cookies, localStorage, and sessionStorage. It does not capture IndexedDB, Cache Storage, service-worker state, passkeys, device-bound tokens, HTTP authentication, or server-side session state. Some services may invalidate restored sessions or require re-authentication, especially after password, security, device, or location changes. Selecting Sign out on a website can revoke the saved token on its server, which local restoration cannot undo. Profiles are isolated by exact website origin, so related subdomains may need separate profiles. Parent-domain cookies applicable to the saved host retain their cookie scope; web storage remains specific to the saved origin.