No Login Data Private Local Save

Shared Storage API Demo - Online Cross‑Site Data

7
0
0
0

Shared Storage API Demo

Privacy Sandbox · Cross-site data isolation · Secure worklet processing

Checking API... Initializing
0
Stored Entries
0 B
Total Size
Worklet Status
Privacy Budget
Retrieved Value:

Worklets run in an isolated environment — no DOM, no network access. Data is processed privately.

🅰️ /page-a.html 🅱️ /page-b.html 🅲 /page-c.html
Selected URL (via worklet):

Worklet Output:
// Write data (requires user interaction context)
await window.sharedStorage.set('key', 'value');

// Read data
const val = await window.sharedStorage.get('key');
console.log(val); // 'value'

// Delete
await window.sharedStorage.delete('key');

// Clear all
await window.sharedStorage.clear();
// worklet.js
class SelectUrlOp {
  async run(urls, data) {
    const group = await this.sharedStorage.get('exp-group');
    const idx = group === 'b' ? 1 : 0;
    return idx; // 0-based index into urls array
  }
}
register('select-url', SelectUrlOp);

// Main thread
const worklet = await window.sharedStorage.createWorklet();
await worklet.addModule('worklet.js');
const selected = await worklet.selectURL(
  'select-url',
  ['/page-a', '/page-b'],
  { data: { campaign: 'spring' } }
);
// HTTP Response Header
Permissions-Policy: shared-storage=(self "https://trusted.example")

// Iframe allow attribute
<iframe allow="shared-storage" src="..."></iframe>

// Meta tag (not all browsers)
<meta http-equiv="Permissions-Policy"
      content="shared-storage=(self)">
Stored Data
# Key Value Size Actions
No data stored yet. Use the operations panel to add entries.
Operation Log
Tool initialized. Detecting Shared Storage API support... Just now

Frequently Asked Questions

The Shared Storage API is a Privacy Sandbox proposal that allows websites to store and access unpartitioned cross-site data in a privacy-safe manner. Unlike traditional storage (like cookies or localStorage), data in Shared Storage is isolated from the embedding context and can only be processed inside a worklet — a restricted JavaScript environment without DOM, network, or communication capabilities. This prevents cross-site tracking while enabling legitimate use cases like A/B testing, frequency capping, and anti-abuse measures.

  • localStorage: Synchronous, same-origin only, accessible from any script on the page. Not suitable for cross-site scenarios.
  • Cookies: Can be cross-site (third-party cookies), but are being phased out. Accessible by servers and JavaScript, raising privacy concerns.
  • Shared Storage: Cross-site data that cannot be directly read by the embedding page. Data processing happens exclusively inside isolated worklets. Outputs are limited (e.g., a URL selection or a privacy-budgeted aggregate report), preventing data leakage.

Key use cases include:
  • A/B Testing: Store experiment group assignments and use selectURL() in a worklet to serve the correct variant without exposing group data.
  • Frequency Capping: Track how many times a user has seen a campaign across sites and cap impressions.
  • Anti-Abuse: Maintain cross-site trust signals (e.g., login attempts) to detect bots.
  • Aggregate Reporting: Use the Private Aggregation API within worklets to generate privacy-safe reports.

As of 2025, Shared Storage API is supported in Chromium-based browsers (Chrome 117+, Edge 117+, Opera 103+). It requires HTTPS and the site must register for Privacy Sandbox enrollment. Firefox and Safari have not yet implemented Shared Storage, though they are exploring similar privacy-preserving storage proposals. Always check Can I Use for the latest support status.

  1. Serve your site over HTTPS (required).
  2. Set the Permissions-Policy: shared-storage=(self) HTTP header (or use the allow="shared-storage" attribute on iframes).
  3. Register your site with the Privacy Sandbox enrollment process at Google's Privacy Sandbox developer portal.
  4. Call window.sharedStorage.set() within a user interaction context (e.g., click handler) — writes require transient activation.
  5. Create and use worklets via window.sharedStorage.createWorklet() for data processing.

A worklet is a lightweight, isolated JavaScript execution environment. In Shared Storage, worklets cannot access the DOM, make network requests, or communicate with the main page. They can only read from Shared Storage and return limited, privacy-safe outputs (like a selected URL index). This ensures that while cross-site data is stored, it cannot be exfiltrated or used for tracking. Worklets are loaded via addModule() and operations are registered using register().

Each individual key-value entry is limited to approximately 10 KB. The total storage budget per origin is subject to a privacy budget that limits how much data can be written over time. Excessive writes may be throttled. The exact limits are browser-defined and may evolve. This budgeting prevents abuse while accommodating legitimate use cases.

Shared Storage is one piece of the Privacy Sandbox puzzle, designed to address specific cross-site data needs that third-party cookies previously fulfilled — such as A/B testing and frequency control. However, it is not a drop-in replacement for all cookie use cases. For identity federation, see FedCM; for interest-based advertising, see Protected Audience API; for measurement, see Attribution Reporting API. Together, these APIs form a privacy-respecting ecosystem.

Shared Storage itself does not mandate a consent UI, but it operates within the broader Privacy Sandbox framework, which emphasizes transparency. Sites should still comply with regulations like GDPR and ePrivacy Directive. Writing data to Shared Storage typically requires transient user activation (a recent click or tap), adding an implicit consent signal. Always consult your legal team for compliance guidance.

In Chrome DevTools, navigate to Application → Storage → Shared Storage to inspect stored key-value pairs. You can also use chrome://settings/adMeasurement to manage Privacy Sandbox settings. For worklet debugging, use console.log() inside worklets — output appears in the DevTools console when the worklet executes. Enable the #privacy-sandbox-ads-apis flag at chrome://flags if the API isn't available in your browser.