@@ -254,6 +254,7 @@ export const make = Effect.gen(function* BrowserImportMake() {
     // identifiable and each tag is handled on its own below. The success side
     // is normalized to one shape too, so the skipped tally survives either
     // engine — Firefox stores plaintext, so nothing there is ever unreadable.
+    const userDataDirectory = definition.userDataDirectory(pathContext);
     const read: Effect.Effect<
       CookieReadResult,
       ChromiumCookieReadError | FirefoxCookieReadError,
@@ -268,6 +269,11 @@ export const make = Effect.gen(function* BrowserImportMake() {
             keychainService: definition.keychainService,
             keychainAccount: definition.keychainAccount,
             linuxSecretApplication: definition.linuxSecretApplication,
+            ...(platform === "win32" && userDataDirectory !== undefined
+              ? {
+                  windowsLocalStatePath: pathContext.path.join(userDataDirectory, "Local State"),
+                }
+              : {}),
             platform,
           });
 
 
@@ -8,7 +8,11 @@ import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as SqlClient from "effect/unstable/sql/SqlClient";
 
-import { readChromiumCookieDatabase, readChromiumCookies } from "./ChromiumCookies.ts";
+import {
+  decryptChromiumValue,
+  readChromiumCookieDatabase,
+  readChromiumCookies,
+} from "./ChromiumCookies.ts";
 import { ChromiumKeyError } from "./ChromiumKeys.ts";
 import { LinuxBrowserSecretPath } from "./LinuxBrowserSecret.ts";
 import { cookieScope } from "./CookieDatabase.ts";
@@ -25,6 +29,13 @@ const encryptChromium = (
 const encryptV10 = (value: string | Buffer, key: Buffer): Uint8Array =>
   encryptChromium("v10", value, key);
 
+const encryptWindowsV10 = (value: string | Buffer, key: Buffer): Uint8Array => {
+  const nonce = Buffer.from("0123456789ab");
+  const cipher = NodeCrypto.createCipheriv("aes-256-gcm", key, nonce);
+  const encrypted = Buffer.concat([cipher.update(value), cipher.final()]);
+  return Buffer.concat([Buffer.from("v10"), nonce, encrypted, cipher.getAuthTag()]);
+};
+
 describe("cookieScope", () => {
   it("keeps a host-only cookie host-only", () => {
     // Chromium stores a host-only cookie without a leading dot. Passing any
@@ -60,6 +71,31 @@ describe("cookieScope", () => {
 });
 
 describe("readChromiumCookieDatabase", () => {
+  it("decrypts Windows v10 AES-GCM records and rejects app-bound v20 records", () => {
+    const key = Buffer.from("0123456789abcdef0123456789abcdef");
+    const host = ".example.test";
+    const bound = Buffer.concat([
+      NodeCrypto.createHash("sha256").update(host).digest(),
+      Buffer.from("windows value"),
+    ]);
+
+    expect(
+      decryptChromiumValue(encryptWindowsV10(bound, key), { gcmV10: key }, host, 24, "win32"),
+    ).toBe("windows value");
+    expect(
+      decryptChromiumValue(Buffer.from("v20app-bound"), { gcmV10: key }, host, 24, "win32"),
+    ).toBeNull();
+    expect(
+      decryptChromiumValue(
+        encryptWindowsV10(bound, Buffer.alloc(32, 1)),
+        { gcmV10: key },
+        host,
+        24,
+        "win32",
+      ),
+    ).toBeNull();
+  });
+
   it.effect(
     "reports the missing key when no cookies can be read, while preserving partial imports",
     () =>
 
@@ -27,6 +27,7 @@ import { ChildProcessSpawner } from "effect/unstable/process";
 import {
   ChromiumKeyError,
   ChromiumKeyFailure,
+  readWindowsKey,
   resolveChromiumKeys,
   type ChromiumKeyMaterial,
 } from "./ChromiumKeys.ts";
@@ -40,6 +41,8 @@ import {
 
 /** OSCrypt's CBC mode uses a fixed IV of 16 spaces rather than a per-record one. */
 const AES_CBC_IV = Buffer.alloc(16, 0x20);
+const AES_GCM_NONCE_LENGTH = 12;
+const AES_GCM_TAG_LENGTH = 16;
 const isChromiumKeyError = Schema.is(ChromiumKeyError);
 
 /**
@@ -153,6 +156,26 @@ const decryptCbc = (
   }
 };
 
+const decryptGcm = (
+  payload: Buffer,
+  key: Buffer,
+  domain: string,
+  schemaVersion: number,
+): string | null => {
+  if (payload.length < AES_GCM_NONCE_LENGTH + AES_GCM_TAG_LENGTH) return null;
+  try {
+    const nonce = payload.subarray(0, AES_GCM_NONCE_LENGTH);
+    const ciphertext = payload.subarray(AES_GCM_NONCE_LENGTH, -AES_GCM_TAG_LENGTH);
+    const tag = payload.subarray(-AES_GCM_TAG_LENGTH);
+    const decipher = NodeCrypto.createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(tag);
+    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return stripDomainBinding(plaintext, domain, schemaVersion)?.toString("utf8") ?? null;
+  } catch {
+    return null;
+  }
+};
+
 /**
  * Decrypts one stored value, choosing the scheme from its prefix. Returns null
  * when no key covers that scheme — including Windows' app-bound `v20`, which
@@ -170,6 +193,14 @@ export function decryptChromiumValue(
   const prefix = buffer.subarray(0, 3).toString("latin1");
   const payload = buffer.subarray(3);
 
+  // Windows' legacy v10 format is AES-256-GCM. App-bound records use v20 and
+  // intentionally have no key here, so they fall through as undecryptable.
+  if (platform === "win32") {
+    return prefix === "v10" && keys.gcmV10
+      ? decryptGcm(payload, keys.gcmV10, domain, schemaVersion)
+      : null;
+  }
+
   // Chromium retries a failed record with a key derived from an empty
   // passphrase, because some Linux clients wrote data that way
   // (crbug.com/1195256). A record whose own key is missing entirely stays
@@ -283,6 +314,7 @@ export interface ChromiumCookieSource {
   readonly keychainService: string | undefined;
   readonly keychainAccount: string | undefined;
   readonly linuxSecretApplication: string | undefined;
+  readonly windowsLocalStatePath?: string;
   /** Supplied by the caller from `HostProcessPlatform` rather than read here. */
   readonly platform: NodeJS.Platform;
 }
@@ -294,12 +326,16 @@ export const readChromiumCookies = Effect.fn("ChromiumCookies.readChromiumCookie
   ChromiumCookieReadError,
   FileSystem.FileSystem | Path.Path | Scope.Scope | ChildProcessSpawner.ChildProcessSpawner
 > {
-  const keys = yield* resolveChromiumKeys({
-    platform: source.platform,
-    keychainService: source.keychainService,
-    keychainAccount: source.keychainAccount,
-    linuxSecretApplication: source.linuxSecretApplication,
-  }).pipe(
+  const keys = yield* (
+    source.platform === "win32" && source.windowsLocalStatePath
+      ? readWindowsKey(source.windowsLocalStatePath).pipe(Effect.map((gcmV10) => ({ gcmV10 })))
+      : resolveChromiumKeys({
+          platform: source.platform,
+          keychainService: source.keychainService,
+          keychainAccount: source.keychainAccount,
+          linuxSecretApplication: source.linuxSecretApplication,
+        })
+  ).pipe(
     Effect.mapError(
       (cause: ChromiumKeyError) =>
         new ChromiumCookieReadError({
 
@@ -8,7 +8,13 @@ import * as Stream from "effect/Stream";
 import * as PlatformError from "effect/PlatformError";
 import { ChildProcessSpawner } from "effect/unstable/process";
 
-import { ChromiumKeyError, readLinuxSecret, resolveChromiumKeys } from "./ChromiumKeys.ts";
+import {
+  ChromiumKeyError,
+  decodeWindowsWrappedKey,
+  readLinuxSecret,
+  resolveChromiumKeys,
+  unwrapWindowsDpapiKey,
+} from "./ChromiumKeys.ts";
 import { LinuxBrowserSecretPath } from "./LinuxBrowserSecret.ts";
 
 type CapturedCommand = {
@@ -226,3 +232,43 @@ describe("Linux Chromium secrets", () => {
     }).pipe(Effect.provide(helperLayer({ exitCode: 2 }))),
   );
 });
+
+describe("Windows Chromium secrets", () => {
+  it.effect("accepts only DPAPI-wrapped non-app-bound keys", () =>
+    Effect.gen(function* () {
+      const wrapped = Buffer.from("wrapped-key");
+      const encoded = Buffer.concat([Buffer.from("DPAPI"), wrapped]).toString("base64");
+      const localState = `{"os_crypt":{"encrypted_key":"${encoded}"}}`;
+      expect(yield* decodeWindowsWrappedKey(localState)).toEqual(wrapped);
+
+      const appBound = yield* decodeWindowsWrappedKey(
+        `{"os_crypt":{"encrypted_key":"${encoded}","app_bound_encrypted_key":"present"}}`,
+      ).pipe(Effect.flip);
+      expect(appBound.reason).toBe("unsupportedPlatform");
+
+      const malformed = yield* decodeWindowsWrappedKey(
+        `{"os_crypt":{"encrypted_key":"${wrapped.toString("base64")}"}}`,
+      ).pipe(Effect.flip);
+      expect(malformed.reason).toBe("readFailed");
+    }),
+  );
+
+  it.effect("unwraps the binary key through PowerShell without placing it in argv", () => {
+    let captured: CapturedCommand | undefined;
+    const wrapped = Buffer.from("wrapped-key");
+    const key = Buffer.from("0123456789abcdef0123456789abcdef");
+    return Effect.gen(function* () {
+      expect(yield* unwrapWindowsDpapiKey(wrapped)).toEqual(key);
+      expect(captured?.command).toBe(
+        "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+      );
+      expect(captured?.args).toContain("-NonInteractive");
+      expect(captured?.args.join(" ")).not.toContain(wrapped.toString("base64"));
+    }).pipe(
+      Effect.provide(
+        helperLayer({ stdout: key.toString("base64"), capture: (value) => (captured = value) }),
+      ),
+      Effect.provideService(HostProcessEnvironment, { SystemRoot: "C:\\Windows" }),
+    );
+  });
+});
@@ -12,8 +12,8 @@
  *   can appear in the same database, so both are derived up front and chosen
  *   per record.
  *
- * Windows is not supported: since Chrome 127 its cookies are encrypted to the
- * browser's own identity (App-Bound Encryption), unreadable by any other app.
+ * - **Windows** legacy Chromium stores protect a random AES key with DPAPI.
+ *   App-Bound Encryption remains deliberately unsupported.
  *
  * @module ChromiumKeys
  */
@@ -23,6 +23,8 @@ import * as NodeCrypto from "node:crypto";
 import { HostProcessEnvironment } from "@t3tools/shared/hostProcess";
 
 import * as Effect from "effect/Effect";
+import * as Encoding from "effect/Encoding";
+import * as FileSystem from "effect/FileSystem";
 import * as Schema from "effect/Schema";
 import * as Stream from "effect/Stream";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
@@ -77,6 +79,8 @@ export interface ChromiumKeyMaterial {
    * after a record's own key fails.
    */
   readonly cbcEmpty?: Buffer;
+  /** AES-256-GCM key used by pre-App-Bound Chromium on Windows. */
+  readonly gcmV10?: Buffer;
 }
 
 const derive = (passphrase: string, iterations: number) =>
@@ -172,6 +176,112 @@ export const readLinuxSecret = Effect.fn("ChromiumKeys.readLinuxSecret")(functio
   );
 });
 
+const WindowsLocalState = Schema.Struct({
+  os_crypt: Schema.Struct({
+    encrypted_key: Schema.String,
+    app_bound_encrypted_key: Schema.optional(Schema.String),
+  }),
+});
+const decodeWindowsLocalState = Schema.decodeUnknownEffect(
+  Schema.fromJsonString(WindowsLocalState),
+);
+const DPAPI_PREFIX = Buffer.from("DPAPI");
+const WINDOWS_KEY_LENGTH = 32;
+const WINDOWS_DPAPI_SCRIPT =
+  "Add-Type -AssemblyName System.Security;" +
+  "$value=[Console]::In.ReadToEnd();" +
+  "$encrypted=[Convert]::FromBase64String($value);" +
+  "$plain=[Security.Cryptography.ProtectedData]::Unprotect($encrypted,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);" +
+  "[Console]::Out.Write([Convert]::ToBase64String($plain))";
+
+export const decodeWindowsWrappedKey = Effect.fn("ChromiumKeys.decodeWindowsWrappedKey")(function* (
+  contents: string,
+) {
+  const state = yield* decodeWindowsLocalState(contents).pipe(
+    Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })),
+  );
+  if (state.os_crypt.app_bound_encrypted_key !== undefined) {
+    return yield* new ChromiumKeyError({ reason: "unsupportedPlatform" });
+  }
+  const wrapped = yield* Effect.fromResult(
+    Encoding.decodeBase64(state.os_crypt.encrypted_key),
+  ).pipe(Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })));
+  const wrappedBuffer = Buffer.from(wrapped);
+  if (!wrappedBuffer.subarray(0, DPAPI_PREFIX.length).equals(DPAPI_PREFIX)) {
+    return yield* new ChromiumKeyError({ reason: "readFailed" });
+  }
+  return wrappedBuffer.subarray(DPAPI_PREFIX.length);
+});
+
+/** Unwraps a key with the current Windows user's DPAPI identity. */
+export const unwrapWindowsDpapiKey = Effect.fn("ChromiumKeys.unwrapWindowsDpapiKey")(function* (
+  wrapped: Buffer,
+) {
+  const environment = yield* HostProcessEnvironment;
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+      const windowsRoot = environment.SystemRoot ?? environment.WINDIR;
+      const powershell = windowsRoot
+        ? `${windowsRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`
+        : "powershell.exe";
+      const handle = yield* spawner
+        .spawn(
+          ChildProcess.make(
+            powershell,
+            [
+              "-NoLogo",
+              "-NoProfile",
+              "-NonInteractive",
+              "-WindowStyle",
+              "Hidden",
+              "-Command",
+              WINDOWS_DPAPI_SCRIPT,
+            ],
+            {
+              env: environment,
+              stdin: Stream.encodeText(Stream.make(wrapped.toString("base64"))),
+            },
+          ),
+        )
+        .pipe(
+          Effect.mapError(
+            (cause) => new ChromiumKeyError({ reason: "keychainUnavailable", cause }),
+          ),
+        );
+      const [plainEncoded, , exitCode] = yield* Effect.all(
+        [
+          handle.stdout.pipe(Stream.decodeText(), Stream.mkString),
+          handle.stderr.pipe(Stream.runDrain),
+          handle.exitCode,
+        ],
+        { concurrency: "unbounded" },
+      ).pipe(Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })));
+      if (Number(exitCode) !== 0) {
+        return yield* new ChromiumKeyError({ reason: "readFailed" });
+      }
+      const plain = yield* Effect.fromResult(Encoding.decodeBase64(plainEncoded)).pipe(
+        Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })),
+      );
+      if (plain.length !== WINDOWS_KEY_LENGTH) {
+        return yield* new ChromiumKeyError({ reason: "readFailed" });
+      }
+      return Buffer.from(plain);
+    }),
+  );
+});
+
+/** Reads and unwraps a legacy Windows Chromium key without exposing it in argv. */
+export const readWindowsKey = Effect.fn("ChromiumKeys.readWindowsKey")(function* (
+  localStatePath: string,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const contents = yield* fileSystem
+    .readFileString(localStatePath)
+    .pipe(Effect.mapError((cause) => new ChromiumKeyError({ reason: "readFailed", cause })));
+  return yield* unwrapWindowsDpapiKey(yield* decodeWindowsWrappedKey(contents));
+});
+
 export interface ChromiumKeyRequest {
   readonly platform: NodeJS.Platform;
   readonly keychainService: string | undefined;