Password Vault stores the credentials you choose to save — website URL,
username, password, notes and folder names — locally in your browser using
chrome.storage.local. This data never leaves your device unless
you explicitly enable Cloud Sync.
If you turn on Cloud Sync, your vault is encrypted on your device with a key derived (PBKDF2 → AES-GCM) from a sync passphrase that you choose. The passphrase, and the encryption key, never leave your device.
The resulting ciphertext is stored using
chrome.storage.sync, which your browser replicates across the
devices signed in to your Chrome profile. We do not operate a sync server,
we do not have an account system, and we never receive your vault, your
passphrase or your credentials. If you lose the passphrase the synced data
cannot be recovered by anyone.
Only when you press Check breaches, the extension computes the
SHA-1 hash of each saved password on your device and sends the
first 5 characters of that hash to the Have I Been Pwned range API
(api.pwnedpasswords.com). Your passwords, full hashes,
usernames and URLs are never sent. The comparison happens on your device.
The extension reads the address of the tab you are on only to find the matching credential and fill its login form. Your browsing history is not recorded, stored or transmitted.
We do not collect, receive, sell or transfer your data to anyone, use it for advertising, or use it to assess creditworthiness. The extension has no analytics and no backend of any kind. The only outside request it makes is the optional breach check described above.
Removing the extension, or using "Disable sync" and clearing the
extension's storage, deletes all of its data. Synced ciphertext is removed
from chrome.storage.sync when you disable sync or uninstall the
extension on your devices.