Is Audio & Voice Recorder safe?
We analyzed Audio & Voice Recorder version 3.1.0's actual code and gave it a 72/100 trust score. This is a broadly legitimate recorder, but its…
Bottom line
This is a broadly legitimate recorder, but its account-linked tracking and cookie access create moderate privacy and security concerns.
What it can access
It can capture microphone or tab audio, save recordings, and access cookies for two authentication sites; these powers fit the recorder but are privacy-sensitive.[Q1][Q4][Q5]
Security weaknesses
An install flow opens an unencrypted page, and large minified bundles make security review harder.[Q8][Q10]
Signs of misuse
It sends usage telemetry and can link activity to account email, IDs, and session information; recording audio stays local in reviewed paths.[Q6][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
The extension requests audio capture, limited authentication-cookie access, storage, and permission to save recordings, which broadly fits an online recorder but includes meaningful privacy-sensitive access.
The extension requests storage, tabCapture, downloads, and cookies permissions, with access limited to paywall.atst.tools and clerk.atst.tools. — manifest.json:1
The recorder captures microphone audio and tab audio, then saves the resulting recording locally. — src/pages/options/index.js:3
The authentication flow uses cookies for the permitted services and sends account-related information during sign-in and premium-status checks. — src/pages/popup/index.js:418-439
Which websites can it run on, and can it read or change what appears on those pages?
It can communicate with the listed websites, but the manifest does not declare automatic page scripts.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: https://paywall.atst.tools/*, https://clerk.atst.tools/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Audio capture uses navigator.mediaDevices.getUserMedia({audio}) and chrome.tabCapture.capture({audio:true, video:false}); no DOM or form access. — src/pages/options/index.js:3
Permissions are storage, tabCapture, downloads, cookies—no activeTab, tabs, or content-script injection. — manifest.json:41
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
The extension can access cookies for its Clerk and paywall authentication domains and can save recordings through the Downloads services. It does not declare permissions for browsing history, bookmarks, or reading the browser’s existing download list.
The extension declares cookies and downloads permissions, with host permissions limited to paywall.atst.tools and clerk.atst.tools. — manifest.json:41-44
The reachable bundled authentication integration references chrome.cookies for authentication state and change monitoring. — src/pages/popup/index.js:418
The recording paths encode audio locally and invoke chrome.downloads.download to save the resulting file. — src/pages/options/index.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can record the microphone, the current tab's audio, or both together. This is the extension's advertised function and requires the user to start recording; I found no camera, location, clipboard, local-file reading, or native-application access.
Declares tabCapture along with storage, downloads, and host-limited cookies. — manifest.json:41-45
Uses getUserMedia for microphone audio and chrome.tabCapture.capture for tab audio, combining the streams only in BOTH mode. — src/pages/options/index.js:recording runtime
Encodes WAV, MP3, or WebA locally and passes a local Blob URL to chrome.downloads.download. — src/pages/options/index.js:audio save handlers
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends product events such as popup opens, button clicks, recording type, duration, shortcuts, and installation to both PostHog and Google Analytics. It also uses Clerk, Supabase, and its paywall service for sign-in and premium status.
Initializes PostHog and sends the same named events to Google Analytics Measurement Protocol with a stored client ID and extension version. — assets/js/constants.js:analytics initialization and el
Emits install and recording-shortcut events, including recording type and duration. — src/pages/background/index.js:1
Emits popup-open and control-click events and identifies signed-in users to PostHog with account ID and email. — src/pages/popup/index.js:application tail
Creates local audio Blobs and downloads them; no network request contains recorded audio. — src/pages/options/index.js:recording save handlers
Does it download or run code, settings, or instructions supplied by a remote server?
PostHog downloads remote analytics configuration that can enable or disable popup autocapture, heatmaps, error collection, and related telemetry settings. External dependency loading is disabled, and I found no path that downloads or executes remote JavaScript.
Fetches remote project configuration and passes it to analytics, autocapture, heatmap, exception, and other telemetry modules. — assets/js/constants.js:PostHog config loader
Sets disable_external_dependency_loading to true, preventing remote analytics helper scripts from being loaded. — assets/js/constants.js:PostHog initialization
Loads the MP3 worker and AudioWorklet only from files packaged with the extension. — src/pages/options/index.js:recording workers
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
On first install it automatically opens an unencrypted HTTP welcome page and registers an uninstall callback containing analytics identifiers. Recording and file downloads still require an explicit shortcut or popup action.
For a first install, opens http://atst.tools/avr-welcome and sets an uninstall URL containing the PostHog distinct and session IDs. — src/pages/background/index.js:1
Starts recording only after an extension command or INIT_RECORD message from its own popup. — src/pages/background/index.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The 2.3 MB popup bundle is minified and mixes the application with Clerk, Supabase, PostHog, authentication, database, and UI libraries. The recording and active analytics/account flows were traceable, but independent review is materially harder than it should be.
A 2,373,146-byte minified one-line bundle contains the main UI, sign-in, premium check, analytics integration, and numerous third-party libraries. — src/pages/popup/index.js:1
A 186 KB minified shared bundle contains the full PostHog client plus extension analytics wrappers. — assets/js/constants.js:1
The small service worker is minified but its recording-state and telemetry behavior remains directly readable. — src/pages/background/index.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Audio encoding uses AudioContext, AudioWorklet (RecorderProcessor.js), MediaRecorder, and a dedicated MP3 Web Worker—no eval or Function constructor. — src/pages/options/index.js:3
Bundled MP3 encoder worker operates as a standard Web Worker with no identified dynamic code execution. — assets/mp3-worker-Ckm175wh.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
chrome.tabs.query({active:true, currentWindow:true}) retrieves the tab ID for tabCapture; no URL is stored or transmitted. — src/pages/background/index.js:1
Google Analytics and PostHog events carry UI action names, recording type, duration, and extension version—not visited URLs or search terms. — assets/js/constants.js:4
Does it create a persistent ID or browser fingerprint to recognize you?
It maintains a PostHog device/distinct ID and session ID plus a separately stored Google Analytics client ID. After sign-in it replaces or links analytics identity with the Clerk account ID and email address, allowing activity to be recognized across sessions.
Creates unauthorized_<UUID> as a persistent Google Analytics clientId and sends it with every GA event. — assets/js/constants.js:Ga and el
Places PostHog distinct and session IDs into the configured uninstall URL. — src/pages/background/index.js:1
Calls PostHog identify with the Clerk user ID and primary email, and stores the user ID as clientId. — src/pages/popup/index.js:account effect
Does it send cookies, session details, authentication data, or page contents elsewhere?
The sign-in and premium check send the expected Clerk session credentials to Clerk/Supabase, and the extension sends the account ID and email to PostHog analytics. Cookie access is limited to the two declared authentication hosts.
Cookie access is restricted to paywall.atst.tools and clerk.atst.tools. — manifest.json:41-45
Identifies the user to PostHog with account ID/email and supplies the Clerk session token to the configured Supabase premium query. — src/pages/popup/index.js:account effect and premium query
Saves recording Blobs to a browser download rather than posting them to a remote endpoint. — src/pages/options/index.js:audio save handlers
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Recording uses navigator.mediaDevices.getUserMedia (microphone) and chrome.tabCapture.capture({audio:true, video:false}) (tab audio) only. — src/pages/options/index.js:3
Permissions include tabCapture, storage, downloads, and cookies; no clipboard, tabs, or activeTab permission for DOM access is declared. — manifest.json:41
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No content_scripts, externally_connectable, or web_accessible_resources keys are present in the manifest. — manifest.json:1-53
The onMessage listener processes runtime messages from extension contexts (popup, options) but has no origin check that would accept web-page messages, and no web page can call chrome.runtime.sendMessage to this extension. — src/pages/background/index.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The options page handles only audio capture, encoding, and chrome.downloads.download for the user's own recordings. — src/pages/options/index.js:1-3
All external URLs are fixed destinations (feedback form, reviews, Discord, support mail, uninstall callback) with no link-rewriting logic. — assets/js/links.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
chrome.downloads.download is called with a locally created Blob URL for the encoded audio file; no URL rewriting or header modification is present. — src/pages/options/index.js:1
No webRequest, declarativeNetRequest, or proxy permission is declared. — manifest.json:41
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No native_messaging permission or native messaging host declarations are present. — manifest.json:1-53
Analytics endpoints are https://us.i.posthog.com and https://www.google-analytics.com/mp/collect; no localhost or 127.0.0.1 addresses appear. — assets/js/constants.js:4
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The 2.3 MB popup bundle is a standard Vite/React build with identifiable library names (Clerk, Supabase, PostHog, Web Audio) and no eval, Function constructor, or dynamic code-loading patterns in extension-owned paths. — src/pages/popup/index.js:1
The MP3 worker is a bundled audio encoder (lamejs or similar) with no network or code-injection behavior. — assets/mp3-worker-Ckm175wh.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No content_scripts, externally_connectable, or web_accessible_resources keys exist in the manifest. — manifest.json:1-53
The service worker's onMessage handler is only reachable via chrome.runtime.sendMessage from other extension contexts (popup, options page), not from web pages. — src/pages/background/index.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Distributes downloaded configuration to autocapture, heatmap, exception, web-vitals, dead-click, and related modules. — assets/js/constants.js:PostHog _onRemoteConfig
Autocapture and pageview collection default on, while external dependency loading and session recording default off. — assets/js/constants.js:default analytics config
Fetches project configuration from PostHog's assets endpoint when the SDK initializes. — assets/js/constants.js:remote-config loader
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
The worker is a standard MP3 encoder (lamejs-based) that processes audio frames on demand; it is not a continuous compute loop. — assets/mp3-worker-Ckm175wh.js:1
AudioWorklet and MediaRecorder processing is tied to the active recording session and stops when recording ends. — src/pages/options/index.js:3
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
No content_scripts or DOM-access permissions are declared; the extension cannot inject into or modify web page forms. — manifest.json:1-53
The options page contains only audio recording controls and a download save screen; no form-manipulation logic is present. — src/pages/options/index.js:1-3