Is Productivity Owl safe?
We analyzed Productivity Owl version 3.0.0's actual code and gave it a 78/100 trust score. Productivity Owl is broadly purpose-aligned but has unusually…
Bottom line
Productivity Owl is broadly purpose-aligned but has unusually broad page access and keeps local activity records.
What it can access
It runs on every website and can monitor domains, save selected full URLs, and block or close pages, broadly matching its productivity purpose.[Q1][Q2][Q4][Q12]
Security weaknesses
Its all-site page access and exposed packaged files increase the potential impact of a mistake, while no major exploit was demonstrated.[Q2][Q21]
Signs of misuse
No evidence shows data leaving the browser, remote instructions executing, or sensitive information being collected beyond local productivity tracking.[Q6][Q7][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests tabs, history, storage, unlimitedStorage and alarms and runs a page access on every URL. Most of that supports page timing/blocking, but the history permission appears unused.
Declares tabs, history, storage, unlimitedStorage and alarms, plus a content script matching <all_urls>. — manifest.json:22-38
Uses tabs and alarms to contact the active tab, collect domain activity and enforce interventions; no chrome.history API call exists in the package. — productivityowl_sw.js:962-1074
Which websites can it run on, and can it read or change what appears on those pages?
It can read the current URL on every normal webpage, add overlays, empty the page and head, and ultimately close or redirect a tab.
Classifies window.location.href, injects countdown UI, and replaces blocked pages by emptying body/head and loading a local block template. — contentscript_owl.js:847-940
Closes the sender tab after a countdown or redirects the sole remaining tab to the extension options page. — productivityowl_sw.js:672-701
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Activity detection listens for scroll and mouse movement and checks whether media is playing; it does not read field contents or keyboard input. — contentscript_owl.js:159-189
The reviewed all-sites content-script bundle contains no live form-value or credential collection path. — manifest.json:36-59
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It keeps its own local browsing statistics by active domain and can save full URLs for later. It does not access cookies, sessions, bookmarks or downloads, and the declared browser-history permission is unused.
Every minute, requests the active content script's domain and increments a per-day local bstats record. — productivityowl_sw.js:1014-1044
A user-triggered Save for Later action sends the complete current URL to extension storage. — contentscript_owl.js:1007-1012
Declares history but not cookies, bookmarks or downloads; no chrome.history call was found. — manifest.json:22-27
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the file, geolocation, capture, clipboard, management or nativeMessaging permissions. — manifest.json:22-32
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
Both fetch calls use chrome.runtime.getURL to read bundled HTML templates from the installed extension. — contentscript_owl.js:1057-1101
The only developer-related web destinations are three fixed project pages opened by an options-page click; no data is posted. — productivityowl_sw.js:807-825
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads allow/block/time settings from the extension's own storage through an internal message. — contentscript_owl.js:77-116
Template fetches resolve to chrome-extension package URLs rather than remote servers. — contentscript_owl.js:1057-1101
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically monitors the active domain, displays interventions and can close timed-out pages without a click at that moment. This is the extension's stated core behavior and is configured by the user.
A one-minute alarm automatically queries the active tab and records its domain when statistics are enabled. — productivityowl_sw.js:985-1046
Countdown completion invokes closeMyTab automatically. — contentscript_owl.js:1245-1269
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No settings-changing, proxy or privacy permission is declared. — manifest.json:22-32
Tab update is limited to redirecting a final timed-out tab to the packaged options page. — productivityowl_sw.js:672-701
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Custom code is readable, but the package includes numerous large minified or legacy third-party UI libraries. They are identifiable libraries rather than concealed extension logic.
Loads jQuery, qTip, MicroModal, PlainDraggable, editable-table and Mustache into every matched webpage. — manifest.json:46-58
The options page loads additional bundled Font Awesome, Yahoo, Sortable, Chart, Date and range-slider libraries. — options.html:16-45
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Legacy Mustache compiler builds a renderer with new Function; no Mustache.compile or Mustache.render call exists outside the library. — jslib/mustache.js:468-485
qTip has a new Function fallback for string HTML5 metadata, but reviewed extension tooltip calls pass fixed local options and do not use that parser. — jslib/jquery.qtip.js:1568-1568
Live template loading explicitly performs simple placeholder replacement rather than invoking Mustache compilation. — contentscript_owl.js:1057-1101
Does it track the websites, pages, searches, or links you visit?
It tracks how many active minutes are spent on each domain and stores those daily statistics locally. The user can disable statistics, and no upload path was found.
Queries the active tab each minute and increments the returned domain in a date-keyed local object. — productivityowl_sw.js:1014-1044
Scroll, mouse movement and playing media update a local activity timestamp used to decide whether a domain is active. — contentscript_owl.js:159-189
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Storage keys describe settings, tasks, local browsing totals and intervention state; no random ID, account token or fingerprint upload is created. — productivityowl_sw.js:1-1100
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Save for Later appends the URL and time only to chrome.storage.local. — productivityowl_sw.js:704-741
No cookies permission exists, and network host access is limited to Google Fonts origins that application code never fetches. — manifest.json:22-32
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Scroll and mousemove handlers only update OWL.LAST_ACTIVE_TIMESTAMP; media checks only detect playing state. — contentscript_owl.js:159-189
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
No externally_connectable declaration authorizes web origins. — manifest.json:1-76
External messages recognize only stopAllCountdowns and relay a local stop message to tabs. — productivityowl_sw.js:1076-1090
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Website mutations are limited to productivity overlays/block pages and a user-triggered local Save for Later action. — contentscript_owl.js:847-1012
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No webRequest, declarativeNetRequest, downloads or proxy permission is declared. — manifest.json:22-32
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Adds localhost to the default local allow list; this performs no connection. — productivityowl_sw.js:32-47
No nativeMessaging permission or private-network host permission exists. — manifest.json:22-32
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Package inventory consists of readable extension code, templates, styles, images, fonts, sound and identifiable bundled libraries; no encoded executable payload was found. — inventory.json:1-1000
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Makes templates/*, sound/*, css/*, js/*, jslib/*, site/* and img/* web-accessible on <all_urls>. — manifest.json:62-74
Accepts stopAllCountdowns from an external extension without checking sender.id. — productivityowl_sw.js:1076-1090
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Page classification deterministically checks user-saved allow, block and time-limit rules. — js/block_logic.js:24-174
Timed activity is driven by fixed local alarms and stored user settings, not remote targeting. — productivityowl_sw.js:972-1074
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
A blocked page checks every 100 ms that its visible block UI remains present; this is aggressive but not hidden compute or mining. — contentscript_owl.js:857-871
A ten-second loop only checks whether audio/video elements are actively playing. — contentscript_owl.js:174-189
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reviewed website-facing code adds extension controls or replaces blocked pages but contains no form action/value rewrite or website-form submission hook. — contentscript_owl.js:1-1422
Bundled task-list/editable-table libraries support extension UI; no live call connects them to a website form. — manifest.json:46-58