Password Vault stores the credentials you choose to save — website URL,
username, password, notes and folder names — locally in your browser using
chrome.storage.local. This data never leaves your device unless
you explicitly enable Cloud Sync.
If you turn on Cloud Sync, your vault is encrypted on your device with a key derived (PBKDF2 → AES-GCM) from a sync passphrase that you choose. The passphrase, and the encryption key, never leave your device.
The resulting ciphertext is stored using
chrome.storage.sync, which your browser replicates across the
devices signed in to your Chrome profile. We do not operate a sync server,
we do not have an account system, and we never receive your vault, your
passphrase or your credentials. If you lose the passphrase the synced data
cannot be recovered by anyone.
The extension reads the address of the tab you are on only to find the matching credential and fill its login form. Your browsing history is not recorded, stored or transmitted.
We do not collect, receive, sell or transfer your data to anyone, use it for advertising, or use it to assess creditworthiness. The extension has no analytics and no backend of any kind.
Removing the extension, or using "Disable sync" and clearing the
extension's storage, deletes all of its data. Synced ciphertext is removed
from chrome.storage.sync when you disable sync or uninstall the
extension on your devices.