Login Sync

Intro

Core infrastructure for syncing sign-in state, forked from CookieCloud with a simplified front-end interface, hardened back-end security, and roughly 40% more performance on Hono + Bun

The fork is licensed under GPL-3.0 and its code is fully open source:

Installing the Browser Extension

1. Sign In to bilibili

Make sure you are signed in to bilibili in the browser where the extension will go

2. Install the Browser Extension

Pick the extension that matches your browser below

3. Turn On Syncing

Once installed, open LAPLACE Login Sync from the browser's extension bar, click Copy Key, then click Save and Sync

4. Configure the Live Chat Overlay

Open the live chat overlay configurator, switch to the Advanced tab, and paste the key into Sync Key at the top

5. Check That It Works

Open the dashboard or add it as an OBS source, and check that chat events show up

Video Tutorial

If you would rather watch than read, follow the video tutorial below

Security and Privacy

Last updated: Jan 4, 2026

What Is LAPLACE Login Sync?

LAPLACE Login Sync is a browser extension that syncs your bilibili sign-in state in the browser

How Does It Work?

When you sign in to bilibili, the browser stores a few "passes" (cookies, technically). A pass works like a hotel key card — with it, the site knows you are already signed in and never asks for your password again

1. The extension you install in the browser (LAPLACE Login Sync) collects these passes on a schedule
2. Once collected, the extension locks them with your own password (encryption), so only someone holding that key can open them
3. The server is only a "safe-deposit counter" — it cannot read what is inside, because you are the only one with the key
4. But when LAPLACE Chat needs a pass, it uses your key to open the box and read the pass
5. With the pass in hand, it calls the authorized bilibili API server-side to obtain the signed-in live chat stream

Why Do I Need This Extension?

Because of bilibili's own restrictions, I have to read your passes (cookies) to get unmasked danmaku

Is It Safe, Then?

This project is a fork of CookieCloud, and its cryptographic security matches CookieCloud's

The server side adds another authentication layer, so even if your sync key leaks completely, whoever holds it can only pull your live chat events through this site's server and cannot reach any other bilibili API ¹

Are There Other Risks?

Handing your passes (cookies) to a third party (this site) is a high-risk act in itself, and I generally do not recommend it — but given bilibili's risk controls, giving up your passes (cookies) is currently the only way to get complete chat data

It's Not That Simple. I'm a Programmer, I Know How This Works — You Store My Cookies Encrypted, but You Can Still Decrypt My Data!

True. Handing over cookies raises two kinds of questions: external ones — whether the server holding the cookies is secure enough to withstand outside attacks; and internal ones — whether the party storing them for you is trustworthy in the first place

• External: since this feature launched in December 2023, there has not been a single leak
• Internal: that one comes down entirely to your own read on this site's credibility

As an External Factor, What Happens If Data Leaks? How Do I Recover?

• If this site's sync key leaks, an attacker or whoever else obtains it can use your sign-in state to read real-time chat from bilibili live rooms. That stream is read-only — exactly what you see in the chat overlay ¹
• If this site's cookies leak, an attacker gets the encrypted cookie data stored here but cannot decrypt it, so the actual cookie contents stay out of reach
• In the extreme case where this site's cookies and its sync data leak at the same time and the attacker can match one to the other, the attacker gains access to your full bilibili account

Each of those three is harder to reach than the last, and all of them are extremely unlikely

So do not share your sync key with strangers. If it leaks by accident, follow these steps:

• In the browser, immediately sign out of the bilibili account used for Login Sync
• Open the LAPLACE Login Sync extension and click Save and Sync — this pushes the unsynced sign-in state to the server, which invalidates your sync state on this site immediately
• Click Reset, then click Save and Sync again — this discards the old sync key and generates a new one
• Sign back in to bilibili
• Open the LAPLACE Login Sync extension again and click Save and Sync
• Replace the old sync key with the new one

As an Internal Factor, What Happens If You Turn Malicious? How Do I Recover?

I can delete your bilibili account outright, and there is no recovery :D

I Don't Trust You, but I Still Want to Use Your Chat Overlay. Any Other Options?

Use a bilibili alt account for Login Sync. Any account in good standing works — registered normally, no real-name verification required, not banned or feature-limited. In the extreme case where this site is fully compromised and every byte of data leaks, or if you believe I would steal your account, all you lose is an alt

The one limitation: because of bilibili's own restrictions, mute events in the dashboard are available only to the streamer's own account and to room moderators. You can of course make that alt a room moderator

I'm a Hacker or Security Researcher — I Found a Vulnerability, How Do I Claim the Bounty?

See Bounty Hunter for details

Server Benchmarks

The new server delivers a roughly 40% increase in performance. Tested on the Apple M2 Max

Crypto Benchmarks

Tested on the Apple M4 Max with bun 1.2.12 and node 22.14.0

Footnotes

1. If you have enabled chat sending, Super Chat sending, or gift sending on the main LAPLACE Live! site, those permissions leak as well ↩ ↩²