Is TubeGuardian - YouTube Parental Control & Screen Time for Kids safe?
We analyzed TubeGuardian - YouTube Parental Control & Screen Time for Kids version 1.1's actual code and gave it a 82/100 trust score. TubeGuardian is…
Bottom line
TubeGuardian is purpose-aligned and reasonably scoped, with moderate access and limited evidence of privacy or security concerns.
What it can access
It can inspect and change YouTube pages, monitor YouTube tabs, and store viewing data for parental controls.[Q1][Q2][Q5]
Security weaknesses
No meaningful exploitable weakness is shown, though the extension performs recurring background checks and its code is compressed.[Q8][Q10][Q16][Q21]
Signs of misuse
It sends parent account and verification details to its service and keeps local viewing logs, but no misuse or unrelated collection is established.[Q6][Q12][Q13][Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can inspect and modify YouTube pages, monitor YouTube tabs, store parental-control data, schedule background work, and show notifications; it has no all-sites access.
Runs content.js on www.youtube.com and requests storage, alarms, tabs, scripting, activeTab, notifications, plus YouTube and YouTube oEmbed hosts. — manifest.json:20-45
Queries YouTube tabs, injects fixed playback checks, resolves channel information, tracks time, and sends state to YouTube content scripts. — background.js:1-13
Which websites can it run on, and can it read or change what appears on those pages?
It pauses and mutes blocked YouTube videos and adds full-page blocking overlays and a remaining-time badge.
pauseVideo pauses and mutes all video elements; showOverlay and showBlockedOverlay insert TubeGuardian blocks, while miniBar creates a draggable time display. — content.js:2-21
When the daily limit is reached, injects a fixed TubeGuardian limit overlay into the active permitted tab. — background.js:3-4
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
Reads titles, descriptions, video elements, and channel state for filtering; it does not query or listen to host-page form inputs. — content.js:1-22
Email, PIN, security-answer, and verification-code fields belong to the extension's own popup and are used for its parent setup and account flow. — popup.js:1-17
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests storage, alarms, tabs, scripting, activeTab and notifications, but not cookies. — manifest.json:28-45
Uses YouTube page data and public oEmbed responses rather than chrome.cookies or document.cookie. — background.js:1-13
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It reads YouTube video titles, descriptions, channel information and playback state and stores parental settings, usage, email, PIN and recovery-answer hashes locally.
Builds keyword text from document.title, #description and channel name and checks whether videos are paused. — content.js:2-14
Stores parentEmail, parentPin, secQuestion, secAnswerHash, keywords, whitelist, blockedChannels, schedule, notifications and usage controls. — popup.js:1-17
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends the parent's email and email-verification or subscription data to webestech.com. No watched-video details or parental-control lists were found in publisher requests.
Every 30 minutes, checkSubscriptionStatus sends userEmail as a query parameter to webestech.com's TubeGuardian subscription endpoint. — background.js:1-2
Trial and Pro checks send the email; verification endpoints receive JSON containing email or email plus the entered verification code. — popup.js:3-15
Current-video URL is sent to YouTube's own oEmbed endpoint for channel resolution, not to webestech.com. — background.js:7-10
Does it download or run code, settings, or instructions supplied by a remote server?
Publisher responses determine subscription and Pro status and can cause local free-tier limits to be applied, but they are not executed as code.
The subscription response supplies isPro and subscriptionStatus; a non-Pro response truncates keywords, whitelist and blocked channels and resets paid-only settings. — background.js:1-2
Trial, Pro, send-code and verify-code responses update extension account state and status messages. — popup.js:4-15
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It automatically checks YouTube tabs every ten seconds, updates usage every minute, checks subscriptions every 30 minutes, and re-evaluates blocks on navigation, focus and visibility changes.
Creates usage and subscription alarms, runs a 10-second playing-tab loop, and handles tab activation, updates and window focus. — background.js:1-13
Rechecks parental controls on time updates, YouTube navigation completion, page visibility, and window focus. — content.js:13-22
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no chrome_url_overrides, chrome_settings_overrides, proxy, privacy, management, debugger, or search-provider capability. — manifest.json:1-46
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The package is small and readable overall, though its three first-party JavaScript files are compressed into long lines rather than shipped as formatted source.
Records only 57,849 unpacked bytes. — inventory.json:1
Security-relevant logic remains plainly named and traceable despite minified line formatting. — background.js:1-13
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
chrome.scripting.executeScript receives fixed packaged functions for a permission check, playback check, channel detection and limit overlay. — background.js:1-13
Uses fixed DOM operations and internal messages without dynamic execution. — content.js:1-22
Does it track the websites, pages, searches, or links you visit?
It observes active YouTube destinations, channel IDs and playback state and keeps local block and usage logs. Watched-video details are not sent to the publisher in the reviewed code.
Queries YouTube tabs, detects watch, Shorts and channel pages, resolves the current channel, and stores currentVideoChannel locally. — background.js:2-10
Logs blocked keyword and channel events with local timestamps under logs, capped at 100 entries. — content.js:2-12
Does it create a persistent ID or browser fingerprint to recognize you?
The parent's email acts as the persistent subscription identity and is retained in local and Chrome-synced storage; no separate advertising identifier was found.
Stores parentEmail locally and in chrome.storage.sync during verification and uses it for later subscription checks. — popup.js:3-16
Periodically sends the stored email to the subscription endpoint. — background.js:1-2
Does it send cookies, session details, authentication data, or page contents elsewhere?
Parent email and email-verification codes leave the browser for the intended account service; PIN and recovery-answer hashes, viewing rules and usage logs remain local.
POSTs email to send-code and email plus verification code to verify-code on webestech.com. — popup.js:13-15
Hashes the PIN and recovery answer with SHA-256 before local storage; no request transmits them. — popup.js:5-11
Keywords, channel rules and block logs are read from and written to Chrome storage without an upload call. — content.js:2-12
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests none of the clipboard, capture, media, download, or native-messaging permissions. — manifest.json:28-45
Page listeners cover YouTube navigation, visibility, focus and dragging the extension badge, not keylogging or media capture. — content.js:1-22
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares neither externally_connectable nor nativeMessaging. — manifest.json:1-46
Handles internal runtime messages from its YouTube content script and extension pages only. — background.js:11-13
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Injected elements are the parental blocking overlay, access-request button, shield icon and time-left badge. — content.js:3-20
Upgrade and billing links appear in the extension popup and open the publisher's Stripe pages rather than altering YouTube content. — popup.js:16
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Declares no webRequest or declarativeNetRequest permission or ruleset. — manifest.json:28-45
Enforces restrictions by pausing video elements and overlaying the page rather than filtering network traffic. — content.js:2-13
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Persistent host access is limited to YouTube domains and the YouTube oEmbed endpoint. — manifest.json:42-45
Does not request nativeMessaging or private-network host patterns. — manifest.json:28-35
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Remote subscription and YouTube metadata responses are parsed as JSON or text and used as account or channel data. — background.js:1-13
Verification responses update fixed status text and stored flags; they do not reach an execution sink. — popup.js:3-15
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Uses internal chrome.runtime messaging and fixed YouTube DOM events, not window message events. — content.js:13-22
No externally_connectable configuration is present. — manifest.json:1-46
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
isWhitelisted returns true when channelId is missing, and checkBlockedContent calls handleAllowedContent when no channel ID is available. — content.js:3-10
Channel detection depends on oEmbed, author-page HTML or current YouTube page structures and can explicitly fail with no channel ID. — background.js:7-10
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Background work is subscription checking, YouTube playback detection, usage accounting, channel resolution and local notifications. — background.js:1-13
Declares no proxy, vpnProvider, nativeMessaging, socket, or all-sites capability. — manifest.json:28-45
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Mutates video playback and extension-owned overlay or badge elements, not host form, input, action, or formAction properties. — content.js:1-22
All form fields handled by the code are inside TubeGuardian's own popup. — popup.js:1-17