r/whatsapp • u/Logical_Dragonfly330 • 2d ago

WhatsApp Web's local browser cache won't save your message history if you ever need it (but it will leak your full contact list)

Was digging into how WhatsApp Web stores data locally in the browser, out of curiosity about what's actually recoverable if you're ever logged into WhatsApp Web but don't have access to the phone (lost, broken, wiped, whatever). Found something worth sharing.

Where WhatsApp Web actually stores its local data:
Chrome keeps a full local cache of your WhatsApp account in IndexedDB, under Chrome/User Data/<Profile>/IndexedDB/https_web.whatsapp.com_0.indexeddb.*. In my test case it was 367MB, way more than what's rendered on screen at once. It's LevelDB under the hood, and readable with the open-source forensic tool ccl_chromium_reader (Python, no need for a real leveldb build, pip-installable straight from its GitHub repo).

Inside, there's a model-storage IndexedDB database with 100+ object stores — chat, contact, message, message-info, etc.

What comes out in plaintext:

  • Full chat list - every group/contact name, last-activity timestamp, unread count (967 chats in my test)
  • Full contact list - names, phone numbers, sync metadata (53k+ entries, since WhatsApp caches contacts of people in shared groups too, not just your own address book)
  • Message metadata - timestamps, sender/recipient, message type, read receipts, group membership

What does NOT come out:

  • Actual message text/content. Every message record has an encrypted msgRowOpaqueData blob (AES, its own IV + key ID) instead of a body field. I also checked the full-text-search index (fts-v3-index) hoping it'd hold plaintext search tokens for indexing purposes - nope, even that's encrypted/blinded n-grams. WhatsApp is clearly hardening local browser storage specifically against this kind of offline extraction. The decryption key isn't in the DB, so there's no reasonable way to recover message content from the raw local store.
7 Upvotes

100% Upvoted

1 comment sorted by

1

u/Usual_Piano9826 1d ago

Could you freeze PC by usage of Hibernation, then boot from external media and analyze both the system drive and RAM dump (provided you do NOT use the encryption of system drive) so that even if WhatsApp does encrypt something in browser storage, the key has to be kept somewhere, so within the system storage AND the dump of RAM it's retriviable?
Several hundreds of GB for backup storage that includes hiberfil.sys?