Is Education Perfect always in focus safe?
We analyzed Education Perfect always in focus version 1.2's actual code and gave it a 88/100 trust score. This is a narrowly scoped, purpose-aligned…
Bottom line
This is a narrowly scoped, purpose-aligned extension with no evidence of data misuse or serious security weaknesses.
What it can access
It can alter what appears on Education Perfect pages, which is necessary for its focus feature but still grants page access.[Q1][Q2]
Security weaknesses
No meaningful weakness is shown: actions are user-triggered, packaged, and not exposed to ordinary websites.[Q8][Q16][Q21]
Signs of misuse
There is no evidence of collecting page data, tracking browsing, or sending user information beyond a font request.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests temporary active-tab access and installs a page access only on Education Perfect. That scope supports the advertised focus behavior and is much narrower than all-site access.
Declares activeTab and matches only *://*.app.educationperfect.com/*. — manifest.json:permissions,content_scripts
Implements only synthetic focus/visibility behavior on the matching page. — content.js:3-30
Uses activeTab to message the selected tab from the user-opened popup. — popup.js:13-18
Which websites can it run on, and can it read or change what appears on those pages?
It runs only on Education Perfect subdomains. There it dispatches focus and visibility events, attempts to override document visibility getters, and can reload the page when disabled.
Limits the content script to the Education Perfect application domain. — manifest.json:content_scripts
Dispatches synthetic events and defines isolated-world visibility getters. — content.js:3-29
Reloads the page when the user turns the feature off. — content.js:35-47
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Full script contains no querySelector, value reads, or form access — content.js:1-65
Popup only sends fixed action strings (turnOn/turnOff/getStatus) — popup.js:1-32
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Permissions array contains only 'activeTab' — manifest.json:7-9
Background worker only logs a fixed string on install — background.js:1-3
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Opening the popup asks Google Fonts for a static Inter stylesheet, which exposes ordinary request metadata to Google. The extension sends no page data, status, identifier, or other application information anywhere.
Links directly to a fixed fonts.googleapis.com CSS resource. — popup.html:6
The worker only logs installation and makes no request. — background.js:1-3
Contains no fetch, XHR, WebSocket, beacon, or remote URL. — content.js:1-65
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
References only packaged background, content, and popup files. — manifest.json:background,content_scripts,action
Loads remote font CSS but loads its executable popup.js from the package. — popup.html:6,64
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
No evidence of this behavior was found in the reviewed package.
On and Off buttons send the only state-changing messages. — popup.js:1-10
The in-memory state defaults off and the automatic load-time branch does nothing unless already active, which cannot persist across reloads. — content.js:32-65
The one-second timer is created only inside keepWindowActive after enabling. — content.js:26-29
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Shows the entire page behavior in plain JavaScript. — content.js:1-65
Shows the complete control UI logic. — popup.js:1-32
The complete worker is one install log listener. — background.js:1-3
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
setInterval receives a fixed arrow-function callback. — content.js:26-29
Contains no dynamic code-generation primitive. — content.js:1-65
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Defines a fixed Education Perfect match rather than monitoring arbitrary browsing. — manifest.json:content_scripts
State consists only of an in-memory isActive flag and timer reference. — content.js:32-65
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Defines only transient JavaScript variables and uses no storage API. — content.js:32-65
Does not request storage permission. — manifest.json:permissions
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Links to fonts.googleapis.com for the Inter font; no user data is appended. — popup.html:3-6
No fetch, XMLHttpRequest, or data-exfiltration calls found. — content.js:1-65
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Registers a blur listener that dispatches a focus event; no input or clipboard access. — content.js:3-7
Overrides document.hidden and visibilityState; no form or input manipulation. — content.js:15-23
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Accepts fixed turnOn, turnOff, and getStatus messages from chrome.runtime. — content.js:50-60
Declares no externally_connectable or web-accessible resources. — manifest.json:1-29
The packaged popup is the component that sends those messages. — popup.js:13-18
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
All DOM interaction is limited to focus-event dispatch and visibility getter overrides. — content.js:3-29
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no network interception, download, or proxy permission. — manifest.json:permissions
Calls location.reload solely to reset its page changes when disabled. — content.js:41-47
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Background worker only logs a fixed string on install; no network or IPC calls. — background.js:1-3
No fetch to localhost, no native messaging, no WebSocket connections. — content.js:1-65
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Entire file is 1,768 bytes of readable logic; no decoding or dynamic execution. — content.js:1-65
Readable popup logic; no hidden payloads. — popup.js:1-32
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Contains no externally_connectable or web_accessible_resources entry. — manifest.json:1-29
Listens only on chrome.runtime messaging and never forwards page events into extension APIs. — content.js:50-60
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Activation is solely gated by the user clicking On in the popup; no user/date/remote checks. — content.js:35-40
Popup simply sends a fixed action string; no conditional branching on user or environment. — popup.js:1-10
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Dispatches one Event object every 1,000 milliseconds while enabled. — content.js:26-29
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Contains all page mutations and no form query or submission handler. — content.js:3-29,35-47