Is Team Password Manager safe?
We analyzed Team Password Manager version 6.42.28's actual code and gave it a 52/100 trust score. This is a legitimate password manager with unusually…
Bottom line
This is a legitimate password manager with unusually broad access and a serious automatic-connection weakness.
What it can access
It can inspect login forms and handle passwords on every website, while storing manager data and sending feature-related data to its configured service; this fits its purpose but is highly sensitive. [Q1][Q3][Q4][Q6]
Security weaknesses
A website can steer automatic manager enrollment, and the configured service may use unencrypted HTTP, exposing credentials or control to interception. [Q14][Q16][Q21]
Signs of misuse
The package shows broad domain observation and credential handling, plus automatic connection behavior without clear confirmation, but no proven advertising, theft, or remote-code abuse. [Q8][Q16][Q21]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests access to every HTTP and HTTPS page, all frames, tabs, sync/local storage, and clipboard writing. That reach is consistent with a password manager but gives the extension high-impact access.
Matches <all_urls> in all frames and requests http://*/*, https://*/*, storage, tabs, and clipboardWrite. — manifest.json:content_scripts, host_permissions, permissions
Which websites can it run on, and can it read or change what appears on those pages?
It reads each page's form structure, watches for dynamically added login forms, inserts password-manager icons and an extension iframe, and can modify login inputs.
Finds visible username/password controls, observes DOM additions, and inserts extension UI next to those controls. — js/contentscript.js:tpmGetLoginFields*, onMutation, fieldsIcons, openLoginSelector
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It handles usernames, passwords, one-time codes, notes, and access URLs. On a detected login submission it reads the entered username and password so it can offer to save them.
Reads loginFields username and password values and sends them to the background on submit, submit-button click, or Enter in the password field. — js/contentscript.js:sendLoginIntent
Retrieves complete password records and OTP values from the configured manager for display or autofill. — js/background.js:TPM_GET_PASSWORD_ID, TPM_GET_OTP
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores sensitive connection settings in Chrome sync storage, including the configured services username and plaintext services password while connected. It also uses local storage for pending captured credentials and UI state.
Writes tpmUsername and the plaintext request.password as tpmPassword through chrome.storage.sync.set. — js/background.js:TPM_CONNECT
Writes the pending login URL, username, and password to chrome.storage.local when offering to save a login. — js/background.js:TPM_SUBMIT
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can write password-manager values to the clipboard after a user copy action. It has no clipboard-read, camera, microphone, location, native-messaging, or installed-extension access.
Requests clipboardWrite but none of the other sensitive device or native-integration permissions. — manifest.json:permissions
Packaged clipboard logic copies values selected from extension UI. — js/clipboard.js:clipboard copy handlers
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends domain searches, connection checks, password searches, password retrieval requests, and user-approved new credentials to the configured Team Password Manager server. No fixed analytics or advertising destination was found.
Builds requests against the stored tpmUrl for domain-based searches, credential retrieval, and saving credentials. — js/background.js:TPM_COUNT_URL, TPM_GET_PASSWORDS_URL, TPM_GET_PASSWORD_ID, TPM_SAVE_PASSWORD
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
All entry points reference local files. — manifest.json:background, content_scripts, action
Remote responses are parsed as JSON and mapped to explicit fields. — js/background.js:fetch response handlers
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Without a click, it records the current domain in sync storage, checks its manager connection, scans login-form structure, and can automatically connect itself to a server advertised by the current page while disconnected.
Immediately saves possible domains, checks connection status, scans login forms, and calls connectExtensionAutomatically. — js/contentscript.js:document.ready
Reads #CETPMURL and starts TPM_CONNECT_AUTO without a user confirmation when its origin matches the page. — js/contentscript.js:connectExtensionAutomatically
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
No proxy, settings, search, management, or privacy permission is requested. — manifest.json:permissions
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Readable switch-based request handlers expose storage and network behavior. — js/background.js:entire file
Readable named functions expose form detection, credential capture, connection, and autofill behavior. — js/contentscript.js:entire file
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
First-party and bundled scripts contain ordinary callbacks and function-valued timers, not text-to-code execution. — js/*.js:dangerous-code primitive review
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Derives the registrable domain/subdomain and sends them through TPM_SAVE_POSSIBLE_URLS and TPM_SAVE_URL on every top-level page. — js/contentscript.js:tpmSiteUrl, document.ready
Stores latest domains in sync storage and includes a selected domain in password-search requests. — js/background.js:TPM_SAVE_POSSIBLE_URLS, TPM_SAVE_URL, TPM_COUNT_URL
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Requests use configured account/session authentication but do not create a separate tracking identifier or fingerprint. — js/background.js:network request handlers
Does it send cookies, session details, authentication data, or page contents elsewhere?
services-mode username and password are sent with Basic authentication to the user-supplied manager URL, which may be HTTP or HTTPS. Saved website credentials are uploaded only after the extension's save flow is used.
Builds Authorization: Basic from the stored username and password and permits a configured http:// or https:// base URL. — js/background.js:TPM_CONNECT and API-mode fetch handlers
Posts a selected login URL, username/email, and password to the configured manager. — js/background.js:TPM_SAVE_PASSWORD, TPM_SAVE_MY_PASSWORD
Does it record typing, form entries, clipboard contents, or screenshots?
It listens for detected login submissions, submit-button clicks, and Enter presses on password fields, then reads the username and password once per attempt. This is scoped credential capture for its save feature, not continuous keylogging.
Captures completed login-field values only from forms marked by its login detector and sends TPM_SUBMIT. — js/contentscript.js:sendLoginIntent and submit/click/keydown listeners
Can a website or remote server send commands that make the extension take actions?
A remote manager controls returned password records and account options but cannot send arbitrary browser commands. More importantly, any current website can become that manager in auto mode while the extension is disconnected if it serves the expected services.
Accepts a page-provided same-origin #CETPMURL and requests an automatic connection. — js/contentscript.js:connectExtensionAutomatically
Fetches the page-selected /ext/connect endpoint and stores the returned account options without user confirmation or a distinct server-authenticity proof. — js/background.js:TPM_CONNECT_AUTO
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Page changes are limited to login-field UI and user-selected credential filling. — js/contentscript.js:page modification paths
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
No proxy, webRequest, declarativeNetRequest, debugger, or downloads permission is requested. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Broad web hosts are allowed, but nativeMessaging is absent. — manifest.json:permissions and host_permissions
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
SJCL encrypts/decrypts only tpmPasswordToSave for repopulating the options form; no decrypted value is executed. — js/background.js:TPM_CONNECT and TPM_CONNECTION_DATA
Can ordinary websites access privileged extension features through messaging or exposed files?
There is no general postMessage or externally-connectable services, but a webpage-controlled #CETPMURL marker is a narrow command bridge: while disconnected, it can cause the extension to enroll that same origin as its trusted manager server.
Reads #CETPMURL from untrusted page DOM, checks only that its origin equals window.location.origin, and sends TPM_CONNECT_AUTO. — js/contentscript.js:connectExtensionAutomatically
No direct external runtime-message surface is declared. — manifest.json:externally_connectable
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Conditional branches correspond to API versus automatic connection, account permissions, password state, and user settings. — js/background.js:message switch
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Work is limited to DOM inspection, password-manager UI, cryptography for one stored setting, and explicit API requests. — js/*.js:compute and network review
Does it change form fields or where a form sends its information?
After the user selects a credential, it writes the username/email and password into detected login inputs and dispatches input/change events. It does not change the form action or automatically submit the form.
Sets login field values and dispatches input/change events for user-selected credentials. — js/contentscript.js:usePasswordDirect, usePassword, useMyPassword, enterField
No assignment to form.action, action attribute rewrite, or programmatic form submission was found. — js/contentscript.js:form review