Is Password Alert safe?
We analyzed Password Alert version 1.38.4's actual code and gave it a 55/100 trust score. Password Alert has a legitimate safety purpose but demands…
Bottom line
Password Alert has a legitimate safety purpose but demands unusually broad access to passwords, typing, pasted text, and every website.
What it can access
It runs on every website and frame, reading page content, typing, pasted text, and some password fields for phishing protection.[Q1][Q3][Q5][Q15]
Security weaknesses
Broad monitoring and a short stored password fingerprint could expose sensitive information or make weak passwords easier to guess.[Q14][Q15][Q1]
Signs of misuse
No clear consumer misuse is shown, but enterprise mode can send account, page, and incident details to administrator-selected services.[Q6][Q12][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs at document start in every frame on every website and has identity/email, notifications, scripting, storage, and tab access. These powers support anti-phishing but create one of the most sensitive possible browser-extension trust positions.
Declares identity, identity.email, notifications, scripting, storage, tabs, and <all_urls> host access. — manifest.json:1
Injects content_script_compiled.js into all frames at document_start, including matching about:blank frames. — manifest.json:1
Configures an OAuth client with the email scope and permits HTTPS connections from extension pages. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It opens a separate password-reuse warning and can replace a suspected phishing tab with a full local warning page. User choices can return, proceed, reset the password, report the site, or allowlist an origin.
Creates a password_warning.html tab on password reuse and updates the suspected phishing tab to phishing_warning.html. — service_worker_compiled.js:65-66
Provides reset, ignore, and persistent local allowlist actions. — password_warning.js:42-85
Provides reporting, back, and visit/allowlist actions and can remove the original phishing tab in enterprise reporting flow. — phishing_warning.js:54-120
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It scans up to the first 120 KB of every non-allowlisted page's HTML for Google-login signatures. On legitimate Google or administrator-configured SSO pages it also reads email and password input values to enroll the protected password.
Reads document.documentElement.innerHTML.slice(0, 120000) and compares it with built-in or managed Google-login signatures. — content_script_compiled.js:42-43
Reads Google account forms and managed-policy username/password selectors during legitimate password enrollment or changes. — content_script_compiled.js:30-41
Enterprise policy can supply SSO form, username, password selectors, and SSO URL. — managed_policy_schema.json:14-18
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
Every key and paste message includes the current full URL and referrer. Those values are used transiently for local warnings and, in managed enterprise mode, can be reported after a security trigger; no general browsing-history log was found.
Keypress, keydown, and paste messages include location URL and document referrer. — content_script_compiled.js:34-36
Uses URL to reset its rolling buffer when page context changes and retains only current transient state. — service_worker_compiled.js:57-59
Enterprise alert POSTs include the full triggering URL and referrer. — service_worker_compiled.js:67-68
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads text being pasted from the clipboard on every monitored page through the paste event and sends the full trimmed text to the extension background for local password comparison. It uses no camera, microphone, screen capture, or filesystem services.
Calls clipboardData.getData('text/plain').trim() for each trusted paste and sends it as the checkString password field. — content_script_compiled.js:36
Requests no capture, downloads, nativeMessaging, or filesystem permission. — manifest.json:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
Consumer mode sends no automatic alert report. Managed enterprise mode POSTs email, organization domain, full URL/referrer, version, password date, OTP/lookalike flags, optional domain secret, and an email-scope OAuth token to the administrator-configured report services.
sendReport returns immediately outside enterprise mode; otherwise builds the alert fields, gets an OAuth token, and POSTs to report_url plus page/ or password/. — service_worker_compiled.js:67-68
Enterprise policy supplies report_url and optional domain_auth_secret. — managed_policy_schema.json:31-33
OAuth configuration requests only the email scope. — manifest.json:1
Does it download or run code, settings, or instructions supplied by a remote server?
Chrome managed policy can supply enterprise email domains, SSO URLs/selectors, page signatures, allow/report-only domains, warning behavior, report services, and authentication secret. This is administrator-controlled local policy rather than downloaded server configuration.
Defines all enterprise-controlled configuration fields. — managed_policy_schema.json:1-34
Loads and applies managed SSO selectors, page signatures, allowed domains, report-only domains, and security contact. — content_script_compiled.js:26-29
Loads managed reporting domain, endpoint, initialization behavior, and domain secret. — service_worker_compiled.js:46-47
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Once a protected password is stored, keypress, keydown, paste, URL/referrer collection, rolling plaintext reconstruction, hash comparison, OTP counting, and lookalike-page inspection run automatically across every non-allowlisted page and frame.
Enables listeners outside Google/SSO/allowlisted sites and registers them globally on window at capture phase. — content_script_compiled.js:34-45
Reconstructs recent typed characters, compares password-length suffixes, detects six following OTP digits, and triggers warnings/reports. — service_worker_compiled.js:56-64
Content script begins at document_start in all frames. — manifest.json:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no proxy, search, privacy, browserSettings, or contentSettings permission. — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Contains the unminified content-script source with comments and descriptive identifiers. — content_script_compiled-bundle.js:18800-19510
Contains the unminified background source including hashing, reporting, message, and warning logic. — service_worker_compiled-bundle.js:16000-17350
Lists the Closure libraries and Password Alert source modules in the content build. — content_script_compiled.MF:1-81
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Complete active content runtime contains no text-to-code primitive. — content_script_compiled.js:1-45
Complete active service worker contains no text-to-code primitive. — service_worker_compiled.js:1-72
References only the compact compiled runtimes, not the -bundle.js source archives. — manifest.json:1
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Persistent cacheData holds salt and password verifier records, not visited URLs. — service_worker_compiled.js:43-44
Current URL exists in transient rolling-key state and is replaced when the page changes. — service_worker_compiled.js:57-59
Network reporting is conditional on managed enterprise mode and an alert. — service_worker_compiled.js:67-68
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Gets profile email via chrome.identity.getProfileUserInfo; no routine analytics request follows. — service_worker_compiled.js:52-53
The only fetch is the managed-enterprise security alert endpoint. — service_worker_compiled.js:67-68
Does it send cookies, session details, authentication data, or page contents elsewhere?
It deliberately reads Google or managed-SSO email/password fields, reconstructs typed passwords, and reads pasted strings. Plaintext is transient; persistent storage holds email/date/length and a random-salted SHA-1 prefix of only 37 bits, which is vulnerable to offline guessing of weak passwords.
Reads legitimate Google/SSO password fields and sends plaintext to the extension background for initial enrollment. — content_script_compiled.js:30-41
Immediately hashes candidate/enrolled passwords and compares rolling typed suffixes against stored verifier entries. — service_worker_compiled.js:59-64
Uses per-install random salt, SHA-1, and retains only 37 hash bits; cacheData also stores length, email, and date. — service_worker_compiled.js:70-71
Managed report can append an OAuth token to authenticate the security event; password and hash fields are absent. — service_worker_compiled.js:67-68
Does it record typing, form entries, clipboard contents, or screenshots?
It is intentionally an all-site key and paste monitor. Trusted keycodes are reconstructed into a short rolling plaintext buffer in the background, pasted text is sent in full, and six digits following a password match are recognized as an OTP.
Sends trusted keypress/keydown codes and full pasted text from each monitored page to the service worker. — content_script_compiled.js:34-36
Typed helper reconstructs characters, shift/caps state, backspace, and punctuation. — service_worker_compiled.js:25-26
Maintains rolling buffers up to protected password lengths and counts a six-digit OTP after a password match. — service_worker_compiled.js:56-59
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares all administrator-controlled parameters. — managed_policy_schema.json:1-34
Applies managed selectors and URLs to password capture and phishing-page classification. — content_script_compiled.js:26-32
Applies managed report URL, warning behavior, password initialization, domain, and secret. — service_worker_compiled.js:46-47
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Displays a clearly branded password-reuse warning and safety actions. — password_warning.html:1-22
Displays a clearly branded suspected-phishing warning and safety actions. — phishing_warning.html:1-21
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no webRequest, declarativeNetRequest, debugger, or proxy permission. — manifest.json:1
Uses tabs.create/update for warnings and fetch only for managed security reports. — service_worker_compiled.js:65-68
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging, downloads, or filesystem-related permission. — manifest.json:1
Only network request targets the administrator-provided managed report URL after a trigger. — service_worker_compiled.js:67-68
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
The sole fetch sends a managed alert and ignores its response body. — service_worker_compiled.js:67-68
Extension CSP permits only self-hosted scripts and declares no remotely loaded script. — manifest.json:1
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Defines no externally_connectable origins or extension IDs. — manifest.json:1
Sends fixed same-extension runtime actions and exposes no listener to page JavaScript. — content_script_compiled.js:30-45
Background ignores runtime messages without a sender tab and dispatches a fixed action list. — service_worker_compiled.js:54-55
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Policy and domain checks determine where credential enrollment, monitoring, lookalike detection, and warnings run. — content_script_compiled.js:26-34
Consumer mode warns locally; enterprise mode reports qualifying corporate-password and OTP events and may suppress user alerts. — service_worker_compiled.js:64-68
Administrators can set allowlists, report-only domains, report URL, and display/initialization behavior. — managed_policy_schema.json:19-32
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Runs in all frames on all URLs at document_start. — manifest.json:1
Scans a bounded HTML prefix and registers capture-phase keypress, keydown, and paste listeners. — content_script_compiled.js:42-45
Maintains bounded rolling buffers and rate-limits password comparisons to 18,000 per hour. — service_worker_compiled.js:56-64
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Submit/unload handlers read username/password values and send them internally; no assignment to form fields or action attributes occurs. — content_script_compiled.js:30-41
Other page interaction is read-only DOM signature checking and keyboard/paste observation. — content_script_compiled.js:42-45