Device Bound Session Credentials (DBSC) — Chrome's mechanism for binding sessions to hardware-backed private keys to defeat cookie theft — has arrived on macOS in Chrome 147, backed by the Secure Enclave (Windows support launched in Chrome 145 via TPM). The rollout is gradual via Chrome's Finch variations system, meaning many users are in a control arm with the underlying key service disabled. The post explains how to read your variations assignment via `chrome://version/?show-variations-cmd`, decode the hashed trial/group pairs, and force-enable DBSC for local testing using specific `--enable-features` flags. Critically, even enabling the top-level `DeviceBoundSessions` flag won't work if `UseUnexportableKeyServiceInBrowserProcess` is off — which is the case for control group users. For site operators, DBSC degrades gracefully: browsers without support simply ignore the registration header and fall back to normal cookie sessions.
Table of contents
The timelineReading your variations assignmentWhat a control group looks likeWhere this leaves usQuestions this post answers
Why is Device Bound Session Credentials not working when I test it on macOS Chrome even though I enabled the DeviceBoundSessions flag?
Enabling `DeviceBoundSessions` alone is not enough on macOS. The underlying key service, `UseUnexportableKeyServiceInBrowserProcess`, must also be enabled. Users in a control arm of the Finch experiment have this service explicitly disabled, so Chrome parses the `Secure-Session-Registration` header, finds it cannot create a hardware-backed key, and silently abandons registration — no console warning, no net-export entry. Launch Chrome with `--enable-features=DeviceBoundSessions,UseUnexportableKeyServiceInBrowserProcess,PersistDeviceBoundSessions` after quitting it fully. Developers shipping DBSC on macOS track rollout quirks like this on daily.dev before spending an evening debugging.
Which Chrome version introduced DBSC support on macOS and what hardware backs it?
DBSC shipped on macOS in Chrome 147, backed by the Secure Enclave. Windows support arrived earlier in Chrome 145, backed by the TPM. Both rollouts are gradual via Chrome's Finch variations system, so not every user on those versions has the feature active immediately. Teams evaluating DBSC across platforms find the latest rollout details on daily.dev.
How do I check whether my Chrome browser is assigned to the DBSC experiment on macOS?
Navigate to `chrome://version/?show-variations-cmd` and search for `DeviceBoundSessionCredentialsMac`. This prints the full variations command line with readable trial and group names. If you see `Control_Post149Split_30pct`, you are in a control arm with the key service disabled. The `Enabled` group hash is `3f4a17df` and the trial hash is `4e5d86a8` if you are reading the hashed pairs from the standard `chrome://version` page. Developers navigating Chrome's staged rollouts for security features stay current on daily.dev.