Chrome Bookmarks

Overview

Chrome stores bookmarks in a JSON file rather than a SQLite database. The file contains a tree structure with multiple root folders, each containing nested folders and bookmark entries. A backup copy (Bookmarks.bak) is maintained automatically by Chrome and may contain bookmarks that have since been deleted from the primary file.

Bookmarks reveal sites of sustained interest to the user, as opposed to history which captures all visits including incidental ones. The hierarchical folder structure can reveal organisational patterns and areas of focus.

File Locations

Database Schema / File Format

The Bookmarks file is a JSON document with the following top-level structure:

{
    "checksum": "hash_of_bookmark_data",
    "roots": {
        "bookmark_bar": { ... },
        "other": { ... },
        "synced": { ... }
    },
    "sync_metadata": "...",
    "version": 1
}

Root Folders

Node Structure

Each node in the tree is either a folder or a bookmark (URL):

{
    "children": [],
    "date_added": "13345678901234567",
    "date_last_used": "0",
    "date_modified": "13345678901234567",
    "guid": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "id": "42",
    "meta_info": {},
    "name": "Example Bookmark",
    "type": "url",
    "url": "https://example.com"
}

Key Fields for Analysis

• name: The user-assigned or auto-generated bookmark name. Renamed bookmarks may differ from the original page title.
• url: The bookmarked URL.
• date_added: When the bookmark was created. This is a WebKit timestamp stored as a string, not an integer.
• date_modified: When the bookmark or folder was last modified.
• guid: Persistent identifier that survives sync operations.
• Folder path: The hierarchical position of a bookmark (e.g., bookmark_bar/Work/Research) reveals user categorisation.

Timestamps

Bookmark timestamps are stored as WebKit format values (microseconds since 1601-01-01 00:00:00 UTC) but encoded as decimal strings rather than integers.

A value of "0" indicates the timestamp was never set.

Analysis Notes

• The Bookmarks.bak file is a backup that Chrome maintains automatically. Comparing it with the current Bookmarks file can reveal recently deleted bookmarks.
• The sync_metadata field and synced root folder indicate bookmarks synchronised from other devices, potentially including mobile browsing patterns.
• Folder hierarchy provides insight into user organisation. For example, folders named "Job Search", "Competitor Analysis", or topic-specific names reveal intent.
• The checksum field is a hash of the bookmark data. If this does not match the actual content, the file may have been tampered with.
• Bookmarks with very recent date_added values alongside much older date_modified values on parent folders may indicate bulk import events.
• The meta_info object can contain additional metadata added by extensions or sync.

Version Differences

The Chrome Bookmarks JSON format has been stable across Chrome versions. The guid field was added in Chrome 80+. The date_last_used field was added in later versions. macfor handles missing fields gracefully.

Tool Support

References

• Chromium Bookmark Model Source
• Chrome Bookmark JSON Format