Is Private DNS safe?
We analyzed Private DNS version 1.0.0's actual code and gave it a 45/100 trust score. This extension has limited browser privileges but collects a device…
Bottom line
This extension has limited browser privileges but collects a device fingerprint, uses insecure connections, and presents DNS protection that it does not implement.
What it can access
The extension requests storage and access to three fixed developer-controlled addresses, which fits license and statistics features but not its advertised DNS protection.[Q1] It also creates and sends a device fingerprint for demo tracking.[Q5][Q6]
Security weaknesses
License and fingerprint information is sent over unencrypted HTTP, allowing network observers to read or alter it.[Q6] The extension displays protection as active without configuring DNS or browser traffic, creating a misleading sense of security.[Q8][Q18]
Signs of misuse
The extension deliberately creates and sends a device fingerprint for one-time demo enforcement, despite its stated privacy claims.[Q13] It also sends license information over plaintext HTTP and presents nonfunctional protection controls as active.[Q14][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests only storage plus access to a fixed IP metrics services and yogvidwankhede.duckdns.org over HTTP/HTTPS. That access supports its stats and license UI, but it lacks every permission needed to change DNS, proxy settings, or browser traffic as advertised.
Declares storage and three developer-server host patterns; no proxy, privacy, webRequest, declarativeNetRequest, or browsing-data permission. — manifest.json:6-14
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines no content scripts or web-accessible application bridge. — manifest.json:1-27
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Prompts for a Private DNS license key inside the extension popup. — popup.js:415-429
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Storage is the only API permission. — manifest.json:6-14
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
For demo tracking it derives a device fingerprint from canvas output, user agent, language, operating-system platform, screen resolution, and timezone. It has no file, location, camera, microphone, clipboard-read, or native-application access.
Builds and SHA-256 hashes a fingerprint from canvas and browser/device characteristics. — popup.js:289-325
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the device fingerprint to yogvidwankhede.duckdns.org for one-time demo tracking and sends purchased license keys for validation, both over unencrypted HTTP. It also fetches global DNS server metrics from a fixed IP over HTTP.
POSTs fingerprint to /validate-demo and license key to /validate-key using http://yogvidwankhede.duckdns.org:4000. — popup.js:504-563
Fetches server metrics from http://129.154.249.32:9053/. — background.js:24-43
Claims no personal-data collection and encrypted HTTPS DNS queries. — privacy-policy.md:5-16
Does it download or run code, settings, or instructions supplied by a remote server?
Remote license responses decide whether premium UI is unlocked, and remote metrics populate query/block/cache displays. However, no remotely supplied DNS settings or executable code exist; premium activation mainly unlocks themes and nonfunctional switches.
Uses allowed/valid server response fields to set premium state and update UI. — popup.js:504-609
Maps fixed server metric fields into locally displayed stats. — background.js:24-43
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The popup starts by claiming protection is active without checking or configuring DNS. Its 30-second timer only rereads local stats; remote stats are fetched when the user opens Stats or presses refresh/test.
Main toggle changes UI state only; stats refresh and unhandled clearCache messaging drive misleading status controls. — popup.js:39-100, 128-139, 247-287
Handles getStats and refreshStats only, with no clearCache or protection action. — background.js:24-45
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No relevant browser-control permission is declared. — manifest.json:6-14
The complete worker only stores/fetches aggregate stats and never configures DNS or network behavior. — background.js:1-47
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable source includes explicit comments, fixed URLs, feature claims, fingerprinting, and duplicate license functions. — popup.js:1-760
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
All executable logic is packaged and timers use function callbacks. — background.js, popup.js:complete files
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
No tabs/history/content-script access is present. — manifest.json:1-27
Displayed numbers come from one server-wide JSON metrics endpoint, not browser traffic. — background.js:24-43
Does it create a persistent ID or browser fingerprint to recognize you?
It deliberately creates a stable device fingerprint from canvas, browser, platform, screen, language, and timezone data to enforce a one-time demo, then sends the hash to the developer. This is tracking even though the policy says no personal data is collected.
Generates a SHA-256 device fingerprint and POSTs it to the demo endpoint. — popup.js:289-325, 504-519
Does it send cookies, session details, authentication data, or page contents elsewhere?
It sends license credentials and a device fingerprint over plaintext HTTP. It does not access browser cookies or sessions and cannot send DNS page contents because it never captures them.
Plain HTTP POST bodies contain either fingerprint or license key. — popup.js:504-563
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
No content script, clipboard, or capture access exists. — manifest.json:1-27
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Branches on server-controlled allowed and valid fields. — popup.js:504-587
Trusts server metric fields for the displayed counters. — background.js:24-43
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Premium activation changes popup classes/state and opens theme controls; it does not install network behavior. — popup.js:346-413, 589-609
Advertises free and premium protection features that are absent from the worker and manifest. — popup.html:727-860
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
DNS_SERVER is declared but never referenced; only a metrics HTTP fetch is performed. — background.js:1-47
No network-control API permission is present. — manifest.json:6-14
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Host access is limited to a public IP and duckdns.org; no nativeMessaging permission. — manifest.json:6-14
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Hashing produces an identifier and JSON fields feed fixed UI/state branches only. — popup.js:289-325, 504-587
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines popup and worker only. — manifest.json:1-27
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Fingerprinting activates specifically when a user enters the public demo key, while purchased keys send a different plaintext validation request. Premium/reviewer behavior is inconsistent because a second validateLicenseKey declaration overrides the first and removes the packaged reviewer-key branch.
Defines validateLicenseKey twice; the later declaration replaces the earlier reviewer-key logic. — popup.js:431-504
Protection banner/toggle is purely visual regardless of user or server state. — popup.js:39-100
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Only a local 30-second UI refresh and one-time demo fingerprint hash are present. — popup.js:278-325
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Upgrade action opens http://yogvidwankhede.duckdns.org:4000/purchase.html. — popup.js:390-413