WhatsApp Web Extractor

WhatsApp Web Extractor (wawf) reads WhatsApp Web’s own storage from a browser profile, or a copy of one, decrypts it and writes an export an examiner can read, check and hand over. It works with Firefox and Chromium-based browsers (Chrome, Edge, Brave, Opera), on Windows, Linux and macOS, from the command line or a window.

Authorized use only:

Use it on your own account, or in a lawful investigation with permission.

The window. All names, numbers and paths in the screenshots are made up. View full size: The wawf window with three steps: browser data, where to save the results, and how to get the message key, plus the command line it will run.

What it does

• Decrypted message text. The at-rest key is captured by signing in once as the linked device, or read from a key file saved earlier, so later runs work fully offline. A wrong key is refused rather than turned into garbage.
• Several output formats. A readable transcript; chats.json, identities.json and contacts.csv; an Android-layout msgstore.db and wa.db that existing Android WhatsApp parsers can read; and a raw dump of every store.
• Every sender named. Each message’s sender is resolved from the profile’s own contacts: address-book name, the contact’s own name, then phone number. When nothing is known, the identifier is printed as it is, never guessed.
• Media recovered from the browser’s cache and checked against each message’s hash, with an option to download what the browser never cached.
• More than the browser holds. --history asks the phone for messages older than the browser’s window; --queue records what WhatsApp’s server is holding for the device without taking it.
• Chain of custody by default. Every file read, every decryption and every output is recorded with SHA-256 hashes in a SQLite case database beside the export.
• One conversation only when that is all an examination covers (--chat).

The profile is only read, never written, and the phone is not modified.

Risk to the account:

The default run (to capture the key), --queue and --history sign in to WhatsApp as the account’s linked device, using a client WhatsApp did not write. --fetch-media downloads from WhatsApp’s servers. Use --offline to avoid the network entirely.

Ways to run it

Interface	Start it with	Use it for
Window	wawf with no arguments, or double-click the Windows .exe	Guided runs; shows the exact command it will run
Command line	wawf <PROFILE> --out <folder>	Scripted and repeatable runs

> wawf-windows-x64.exe "E:\Case\Evidence\Edge\User Data\Default" --out E:\Case\Export

Every run from the window is an ordinary command-line run, with the same audit trail, and can be repeated from a terminal or quoted in a report.

Requirements

Item	Requirement
Windows	The wawf-windows-x64.exe release binary; no Python needed
Linux	The wawf-linux-x64 release binary, or Python with the listed packages
macOS	Python with the listed packages
Network	Only for key capture, --history, --queue and --fetch-media

Next steps

• Install WhatsApp Web Extractor.
• Usage: acquiring a profile, options, output formats, chain of custody and exit codes.
• Changelog.

Source and license

WhatsApp Web Extractor is open source under the Apache License 2.0. Source code, the full documentation and issues are on GitHub.