Is Pomodoro Grande: Advanced Productivity Timer safe?
We analyzed Pomodoro Grande: Advanced Productivity Timer version 2.7.6's actual code and gave it a 82/100 trust score. This is a purpose-aligned…
Bottom line
This is a purpose-aligned productivity extension with broad page access and a minor page-restoration weakness, but no established abuse.
What it can access
It runs on every website and can replace pages during local focus sessions, which fits its blocker but gives it broad page access. [Q1][Q2]
Security weaknesses
Replacing and rebuilding whole pages can lose temporary page state and event handlers when blocking ends. [Q2]
Signs of misuse
No evidence shows tracking, credential collection, remote commands, or other misuse; network activity is limited to fixed media and font resources. [Q6][Q14][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can run on every website and has storage, notification, and offscreen-audio access. The all-site access is used by its advertised website blocker, and it requests no tabs, history, cookies, request, or capture permission.
Declares storage, notifications, and offscreen permissions only. — manifest.json:23-27
Injects the blocker content loader on <all_urls>. — manifest.json:32-40
Exposes packaged blocker resources and media assets to all sites. — manifest.json:42-56
Which websites can it run on, and can it read or change what appears on those pages?
During a running focus session it replaces the entire head and body of a user-blocked site with a focus page. It later restores saved HTML, but that reconstruction can lose runtime state and event handlers.
Saves document.body.innerHTML and document.head.innerHTML, then overwrites both with the blocker interface. — content.tsx.js:1-19
Restores the saved strings when blocking ends; innerHTML restoration does not restore JavaScript object state or event listeners. — content.tsx.js:19
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The blocker copies the page's head and body markup into in-memory variables solely to restore it later. It does not inspect or transmit that markup, and current user-entered form property values are generally not represented by innerHTML.
Copies document.body.innerHTML and document.head.innerHTML before displaying the local blocker. — content.tsx.js:1
The saved strings are only reassigned to the same document during unblocking; no message or network sink is present. — content.tsx.js:19
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
Each page reads its own current URL to compare the hostname against local block and allow lists. It does not enumerate tabs, retain visited URLs, or send the current URL elsewhere.
Passes window.location.href to the local site-match helper while evaluating whether to block. — content.tsx.js:19
Parses the URL, strips www, and compares it with blockedSites and exact allowedUrls from chrome.storage.local. — sites.js:1
Requests no tabs or history permission. — manifest.json:23-27
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests offscreen but no clipboard, capture, download, or filesystem permission. — manifest.json:23-27
Creates Audio objects for selected notification and focus tracks and exposes play, stop, toggle, and volume operations. — offscreen.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Selected notification sounds and focus music stream from fixed Cloudinary URLs, and a blocked page loads a Google Font. No application data, page content, browsing history, identifiers, or analytics events are sent to the publisher.
Contains fixed res.cloudinary.com URLs for six notification sounds and ten focus-music tracks. — background-musics.js:1
Loads only the selected fixed audio URL through the browser Audio element. — offscreen.js:1
The replacement block screen links to a stylesheet at fonts.googleapis.com. — content.tsx.js:2
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Loads timer settings and block lists from chrome.storage and contains no fetch or remote-configuration client. — background.ts.js:1
Site decisions use only locally stored blockedSites and allowedUrls. — sites.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The timer service worker continues in the background, and a content bundle loads on every site automatically to enforce the block list. Page replacement occurs only during a user-started focus session on configured domains.
Registers a background service worker and an all-URL content script. — manifest.json:28-40
Runs timer intervals, badge updates, audio, notifications, daily resets, and local history recording. — background.ts.js:1
Automatically watches local timer/list changes and reevaluates the current page. — content.tsx.js:19
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no browser-setting, proxy, search, or privacy permission. — manifest.json:23-27
Uses chrome.action only for its badge text and colors. — background.ts.js:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Large minified bundle has clear library licenses and readable extension-specific storage/UI logic. — popup.js:1
Contains bundled React plus a small readable local hostname matcher. — sites.js:1
The approximately 907 KB unpacked package consists of ordinary JavaScript, CSS, HTML, and image assets. — inventory.json:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Complete text search found no eval or Function-constructor call. — popup.js:1
Complete text search found no eval or Function-constructor call. — sites.js:1
Timer callbacks are bundled functions, not string code. — background.ts.js:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Uses window.location.href for an immediate local block decision only. — content.tsx.js:19
Hostname matcher returns a boolean without writing the URL. — sites.js:1
pomodoroHistory stores dates, counts, completed-task totals, and work minutes—not visited sites. — background.ts.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no analytics SDK, beacon, network request, or generated tracking identifier. — popup.js:1
Stores productivity state only and makes no telemetry request. — background.ts.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Requests no cookies, webRequest, identity, or debugger permission. — manifest.json:23-27
The blocker copies markup for restoration but contains no cookie, password, input-value, or credential logic. — content.tsx.js:1-19
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
The sole key listener checks whether the key equals Tab and calls preventDefault; it does not record key values. — content.tsx.js:19
Requests no capture permissions. — manifest.json:23-27
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Handles a fixed set of local timer, badge, and reset messages. — background.ts.js:1
Sends those fixed messages from the extension UI; no network command source exists. — popup.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Replaces the page with a clearly branded 'site is blocked during your focus session' notice. — content.tsx.js:1-19
Activation requires a hostname on the user's local blockedSites list and no exact allowedUrls exception. — sites.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, proxy, or webNavigation permission. — manifest.json:23-27
Implements blocking entirely through document head/body replacement. — content.tsx.js:1-19
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or filesystem-related permission. — manifest.json:23-27
All non-extension media destinations are fixed public Cloudinary HTTPS URLs. — background-musics.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote URLs point to MP3 media only. — background-musics.js:1
The block screen loads Google Fonts CSS and a packaged extension stylesheet, not remote script. — content.tsx.js:2-3
Dynamically imports the fixed packaged content.tsx.js through chrome.runtime.getURL. — content.tsx-loader.js:4-11
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no externally_connectable senders. — manifest.json:1-58
Communicates only with chrome.storage and installs no message bridge from page JavaScript. — content.tsx.js:1-19
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Blocks only when isRunning is true, the timer is neither paused nor on break, and the current URL matches local settings. — content.tsx.js:19
Other conditions implement disclosed timer/break/ultra-focus behavior. — background.ts.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runs the content loader on all URLs. — manifest.json:32-40
Records sites.js at about 144 KB and content.tsx.js at about 2.3 KB. — inventory.json:1
Appends crx-root and mounts React on every page regardless of whether blocking is active. — content.tsx.js:19
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Only whole-document replacement and restoration are implemented; no form, action, input value, submit, or event interception logic exists. — content.tsx.js:1-19
Popup forms edit extension settings and tasks within the extension page only. — popup.js:1