🏋️ Browser Gym

Server-set (HttpOnly) — the Worker sends real Set-Cookie response headers so cookies land in cookies.sqlite and survive page reloads. Browsers hard-cap cookies per origin at ~150–180; extras are silently dropped. JS-set cookies are also written for comparison but are limited to the same cap.

Writes entries to localStorage. BleachBit can clean this via the browser's storage APIs. Handy for verifying that localStorage items appear and are removed after cleaning.

Writes entries to sessionStorage. Lives only for the current tab session — cleared automatically on tab close, but present in the browser's memory while open.

Creates an IndexedDB database and writes records. Browsers store IndexedDB data in LevelDB (Chrome) or SQLite (Firefox) on disk.

Uses the Service Worker Cache API to store synthetic responses on disk. Tests whether BleachBit clears cache storage (separate from HTTP cache).

Opens popular tracker-heavy sites in separate tabs. Each visit deposits cookies, fingerprinting scripts, and cached resources — a realistic "dirty browser" state. Pop-up blocker must allow this site, or click the links individually below.

Pushes fake URL entries into history.pushState. This populates the browser's in-memory session history, though not the persistent disk history (for that, visit the tracker tabs).

Submit these forms to teach the browser your fake credentials and address. Firefox stores form history in formhistory.sqlite and saved logins in logins.json / key4.db. Chrome uses its own encrypted store. Fill and submit each section — the browser will offer to save the data.

Generates a simple plain-text file with Content-Disposition: attachment so the browser records a download history entry. Useful for checking Chrome's History DB and Firefox's downloads.sqlite.

Runs all local exercises at once: cookies, localStorage, sessionStorage, IndexedDB, Cache API, and history. Does not open tracker tabs (do that separately).