Portage

Browser Transitioning Tool by pvrz

Bulk-migrate chrome extensions and cookies between chromium browsers. Opens chrome web store pages in labeled tab groups for extensions, and provides encrypted JSON export/import for cookies.

github: https://github.com/pvrzz/portage

install (load unpacked)

1. unzip somewhere stable (chrome points at the folder, not a copy)
2. open chrome://extensions
3. enable developer mode (top right)
4. click "load unpacked" and select the folder
5. pin Portage from the puzzle icon

features

two-pane interface — top tabs switch between extensions and cookies. each has installed/imported sub-tabs.

extensions — select the ones you want, "open in tab group" opens all their chrome web store install pages in a labeled cyan tab group. drag the group title to detach into its own window. cross-machine works via an HTML export that's also a standalone clickable page.

cookies — grouped by domain, expand to inspect individual cookies (with secure/httpOnly/session flags). export as JSON with optional AES-GCM encryption (passphrase-protected via PBKDF2). import reads the same format and applies cookies back to the browser, preserving security flags.

encryption details

• PBKDF2 with SHA-256, 250,000 iterations
• AES-GCM 256-bit
• 128-bit random salt, 96-bit random IV per export
• format declares algorithm and parameters for forward compatibility
• runs entirely in your browser via Web Crypto API, no library deps

permissions

permission	reason
management	list installed extensions
tabs + tabGroups	create the install tab group
downloads	save export files
cookies	read and write cookies for migration
<all_urls>	required for cookies api to access all domains

no network access, no remote scripts, no analytics. ~1030 lines across 5 files, all local.

file structure

portage/
├── manifest.json       mv3 manifest
├── popup.html          ui structure
├── popup.css           styles
├── popup.js            logic + crypto
└── icons/              16/48/128 png

known limits

• popup closes when it loses focus during operations — don't click outside mid-encryption
• cookies file is essentially session tokens. always encrypt for transfer, never send or email; especially when it's unencrypted
• some sites use device fingerprinting or token rebinding that defeats cookie migration. re-login on important services (banking, financial, work portals)
• sideloaded/dev-mode extensions show a "sideload" badge — they won't have web store pages

license

MIT-style: do whatever, attribute if you fork.