Password Vault
Password Vault
Password Vault (Chrome extension) · Last updated 20 August 2026
Summary: Password Vault does not collect, transmit, or share any of your data. It makes no network requests of any kind. Everything it stores stays encrypted on your own computer.
Password Vault stores the logins you choose to save — website address, username, password, and any notes you add — along with your settings.
All of it is encrypted with AES-GCM-256 before being written to your browser's local extension storage. The encryption key is derived from your master password using PBKDF2-SHA256 with 600,000 iterations. Your master password itself is never stored, in any form, anywhere.
If you turn on Touch ID unlock, a second copy of the encryption key is stored wrapped under a key that your Mac's Secure Enclave will only reproduce after a successful fingerprint check.
Nothing. Password Vault has no server, no account system, no analytics, no crash reporting and no telemetry. It makes no outbound network requests. Your data cannot be sold or shared with anyone because it never leaves your device.
To fill a login, the extension needs to see the page you are on:
It reads and writes only login form fields, only when you ask it to. It does not record your browsing history or the content of the pages you visit.
| Permission | Why it is needed |
|---|---|
| storage | Stores the encrypted vault and your settings on your own device. |
| scripting | Locates sign-in forms across a page's frames so the correct field is filled. |
| tabs | Reads the current tab's address to show only the logins saved for that site. |
| alarms | Runs the auto-lock timer and the delayed clipboard clear. |
| idle | Locks the vault when you step away from the computer. |
| offscreen | Clears a copied password from the clipboard; the background worker has no page of its own. |
| favicon | Shows each saved site's icon, using icons your browser has already cached. No request is made to the site. |
| clipboardWrite | Copies a username or password when you click copy, and blanks the clipboard afterwards. |
| clipboardRead | Confirms the clipboard still holds the copied password before overwriting it, so unrelated clipboard content is never destroyed. |
| Host access (all sites) | Sign-in forms exist on any website, so the extension must be able to detect and fill fields wherever you choose to log in. |
When you copy a username or password it goes to your system clipboard. After a delay you control (30 seconds by default), the extension clears it — but only after checking that the clipboard still holds what it put there, so anything you copied since is left alone. That check compares a cryptographic hash, so the copied value is never stored in order to perform it.
The backup file the extension produces is encrypted and cannot be read without your master password. If you import passwords from a browser's export file, that file is plaintext and is created by your browser, not by this extension — delete it once the import is done.
Removing the extension from Chrome deletes its stored data. You can also delete individual logins at any time from the extension's list.
There is no recovery mechanism. If you forget your master password, your vault cannot be decrypted by anyone, including the developer. Keep an encrypted backup somewhere safe.
Password Vault is not directed at children and collects no information from anyone, regardless of age.
If this policy changes, the updated version will be published on this page with a new date at the top.
Questions about this policy can be raised as an issue on the project's GitHub repository.