As anyone can see network data using browser developer tool, can someone get access to my cookies or API keys by just turning on the developer tool in Chrome or Firefox?

For example, imagine a webapp that sends api key in header with each request. Could someone see this key by just turning on "inspect" in Chrome?

Likewise, if i have an active Facebook session and I gave my system to someone for browsing, could they check for cookies or api keys by just using "inspect" in Chrome?

Is there any way to avoid this?

1 Answer 1


Once someone has access to your computer then can get absolutely everything you have access to. If this was not possible, then you would not be able to do those things either.

The way to avoid this is to not give someone access to your computer or your logged in session on the computer. Log out and have them log into another user.

  • Thank you so much for replying , Is there any way to avoid exposing api key through developer tool ?
    – PDHide
    Oct 11, 2019 at 14:47
  • AFAIK, no it is not possible to avoid exposing cookies or API keys through the developer tool. Even turning off cookies or Javascript will not help as the inspect tool can also intercept the HTTP responses.
    – bhorkarg
    Oct 11, 2019 at 14:58
  • @PDHide the API key is exposed on your computer because you need to use it. So, no, you can't somehow randomly hide it. But I suspect that you might have been meaning all along that you think that someone using another computer could open up their "developer tool" and see all traffic from all computers on the network. Is this true?
    – schroeder
    Oct 11, 2019 at 16:09
  • @schroeder No , i saw an application were the eye button in API key field in UI remains active even if user clicks outside. So when i was talking to developer, he told that if the eye get disabled for ever when user clicks outside the field, someone can still see the password by going to developer tool and checking the headers
    – PDHide
    Oct 11, 2019 at 16:22
  • Right, but that is all still on that local computer in that specific session. The API key is not exposed. It's there because it needs to be used. There is no inappropriate disclosure or access to this data.
    – schroeder
    Oct 11, 2019 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .