Why sessions from regular Chrome no longer transfer

Morfiade is a Google Chrome profile manager for Windows. Each account lives in its own profile with its own cookies and proxy and stays signed in, and switching between accounts is one click.

A familiar situation: a new computer or a Windows reinstall — and every site asks you to log in again. Dozens of services, email and phone confirmations, a forgotten password here, lost access to the inbox that the code goes to there. It used to be fixed by copying the profile folder. Not anymore, and it's not your fault.

What changed

Starting with Chrome 127, the browser encrypts cookies in a new way — so-called App-Bound Encryption. Only Chrome itself can decrypt them, and only on the machine where the file originally lived. Copy the profile folder to another computer, and the cookies inside turn into unreadable garbage; on the very first launch Chrome cleans them out as corrupted. The size is all there, but there are no logins.

This was done against programs that stole sessions. The side effect is that an ordinary person can no longer move their own logins to a new computer by simple copying.

Google sync doesn't solve this

The logical response is to sign in to a Google account and let sync pull everything in. And it will — bookmarks, history, passwords. But not cookies. Sync doesn't carry site sessions at all — that's simply not something it does. So after signing in to the account on the new machine, you get your bookmarks back and log in to every site by hand all over again.

Easy to check: sign in to a Google account on a new computer and open any site you were logged into on the old one — it will ask you to log in. The bookmarks are already there, the sessions are not.

What you can actually do about it

The key is where you log in to the site. Cookies that Chrome has encrypted with its new method can't be taken with you. But cookies that were created from the start in a separate profile — can: they transfer in a readable form, not as an encrypted file.

That's exactly how Morfiade works. Each account lives in its own sandbox profile, and when you log in to a site inside such a profile, that session becomes transferable:

when moving to a new computer — the profile goes along with the login, no need to sign in again;
when reinstalling Windows — a profile you saved beforehand comes back with a live session;
on several machines at once — the same profile works both at home and on a work laptop, and you're logged in on both.

The difference is simple: you can no longer take a session out of regular Chrome, but a session created through Morfiade — you can, because from the very start it lives in a place it's allowed to be moved from.

What this looks like in practice

Create a profile in Morfiade and log in to the sites you need inside it — a normal login, just once.
Export profiles — the program packs a single file with the profiles, cookies, proxies, and your notes. The cookies in it are saved so they'll open on any machine.
Move the file to another computer and do an Import — the profiles come back together with their sessions. Open the site and you're already logged in.

Storage and transfer are local: the file sits with you, not on someone else's server, and the process doesn't depend on any third-party cloud being available.

What about passwords and logins

Here everything comes down to one question: where they're stored — in the browser itself or in your Google account. That determines whether they travel or not.

We transfer cookies so they open on any machine — but Chrome encrypts passwords with a key tied to the Windows account. So you simply can't copy the password file to another computer: there's nothing there to decrypt it with. This applies both to passwords saved directly in the browser and to those stored in a Google account. There's a separate, reliable path for them — export as a file.

How to move them anyway

Chrome has its own file-based transfer, and it works exactly where the account is open:

On the old computer. Open chrome://password-manager/settings → "Export passwords". Chrome will ask you to confirm your Windows sign-in — that's expected, it's a built-in safeguard.

On the new computer. Same address → "Import passwords" → choose the file.

A nice side effect: after the import, the passwords become local. From then on they travel with the profile on their own, and you won't need to repeat this.

⚠️ The export file contains all your passwords in plain text. Delete it immediately after importing and don't leave it sitting in the "Downloads" folder.

We deliberately don't do this step for you and don't ask you to trust us with your passwords: the file should pass through your own hands and appear nowhere else. The program runs on your computer, and passwords are the one thing we consciously never touch at all.

The second lock, which almost nobody writes about

Encryption is only half of the restriction. The other half arrived in Chrome 136: the browser stopped listening to the --remote-debugging-port and --remote-debugging-pipe flags when running with the default profile folder. The debugging channel is now only permitted alongside --user-data-dir pointing to a separate folder.

Why Google did this: through the debugging channel, a single command hands over all profile cookies at once — including those that scripts on the page cannot reach. Once the new encryption shut down reading the files directly, people started pulling sessions this way instead, so that door was closed right after.

What this means in practice: a third-party app — one that reads profile files or launches Chrome with a flag — won't be able to pull sessions from your primary Chrome. Not because it lacks the ability, but because the browser simply won't allow it.

"Can't I just do it manually?"

You can, and not just one cookie at a time. Both "locks" mentioned above are about grabbing a session externally with a program: via a file on the disk or via a debugging key. But cookies that the browser itself sees can also be exported manually — using a cookie management extension from the official Chrome Web Store, such as Cookie-Editor. It works from inside an already running Chrome, using the standard cookies permission that you confirm yourself during installation — and not via a file on the disk or a debugging channel. Therefore, both locks simply do not apply to it.

Migration process:

Install Cookie-Editor in your regular Chrome, click ⋮ → "See All Options" in its window, and in the "All Cookies" section select "Export All Cookies → As JSON": cookies from all sites will immediately go to the clipboard (the "Done!" message might not appear, and the page might scroll down — this is normal). The export button in the extension window itself is not suitable here: it only exports cookies for the currently open site. There is a "Delete All" button nearby — it deletes all browser cookies, do not click it. Open Notepad, paste the cookies (Ctrl+V) and save the file with a name ending in .json, for example cookies.json.
In Morfiade, select the profile (or create a new one) and click "Import cookies" — the program understands the Cookie-Editor format without any modifications: we verified this on a real export from regular Chrome: thousands of cookies from hundreds of sites, the logins remained. Before importing, the program will show how many cookies it found in the file and on how many domains, and if it doesn't understand the format, it will tell you directly rather than keeping silent.
From then on, the profile travels between computers as usual — via Morfiade profile export and import, as described above.

⚠️ The file with cookies contains live logins to all your accounts. After importing, delete it and the extension itself, and do not send it to anyone.

You can also return sessions to regular Chrome — for example, on a new computer after reinstalling Windows — and you don't need an extension for this. Once a profile in Morfiade is assembled (bookmarks, extensions, and cookies brought over by an extension), the "Replace Chrome" button in the "Chrome settings" window turns regular Chrome into this profile, and sessions open exactly as they were: the profile is moved in its entirety, along with the encryption key, so the cookies can be read. The previous contents of Chrome are not deleted, but set aside into a backup folder nearby. On another computer, first transfer the profile via Morfiade export and import, and then do the same thing.

We do not recommend going back via the extension: it parses someone else's file in its own way, and the cookie's lifetime or scope might not be preserved.

⚠️ After the replacement, the profile lives in the regular Chrome folder, and new logins there are once again heavily protected — you won't be able to copy them back with simple copying. Therefore, make a backup in advance, using Morfiade profile export. And do not replace the Chrome cookie database file itself while the browser is not running: on the next launch, it might consider the file corrupted and clear it — along with the sessions that were already there.

The extension route still has its caveats:

Cookies are not the whole session. Some sites keep the login not in cookies, but in the page storage. The extension won't see such a session.
The site on the other end must accept it. A major service has the right to ask you to confirm a login again if it arrives from a different address and device.
The extension is a third-party tool. We do not make or check it; you consciously install it and grant the cookies permission yourself, from the official store.

So what is the product for? The extension solves a one-time migration, while Morfiade handles what happens after. The profile lives in its own folder from the very beginning, then travels as a single file along with everything else, and the extension is no longer needed for this.

Honest limits

So there are no false expectations:

Existing sessions from your regular Chrome are not transferred by the app on its own — why that is and what you can still do by hand is broken down above. The sessions that get transferred are those created or loaded into Morfiade profiles: either you log into the site once inside the app, or you bring in ready-made cookies via an extension — after that, the login travels with the profile.
Passwords travel if they're saved in the profile itself; if they're in a Google account — via file export, as described above.
On the new computer, the browser shouldn't be older than it was on the old one: an old version will refuse to open a fresh profile.

In short

Chrome closed off session transfer on purpose, and Google sync doesn't carry sessions over — that can't be fixed. But if you log in to sites through Morfiade, sessions stay yours and transferable: between computers, after a system reinstall, and on several machines at once. Not "stop using Chrome," but stop logging in over and over.