Permissions explained
Can Chrome extensions read your passwords?
Sometimes. An extension that can run code on a sign-in page may be able to observe or alter parts of that page, including form fields, depending on how the page and extension are built.
The short version
Password-manager protections and browser boundaries help, but a content script with access to a website can interact with that page’s document. Code can listen for typing, read many input values, alter a form destination, or watch data as a form is submitted. A permission warning does not prove that the extension does any of those things; its source behavior matters.
What to check
- Host access: Does it run on every website, only a named site, or only after you click it?
- Input listeners: Does the code read password, payment, message, or other form fields?
- Form changes: Can it replace a form action or send field values somewhere else?
- Network destinations: Are sensitive values sent to the publisher or an unrelated service?
- Purpose: Is this behavior necessary for what the extension promises to do?
Reduce your risk
Prefer “on click” or site-specific access when Chrome offers it. Remove extensions you no longer use. Be especially cautious with broad-access extensions on banking, email, healthcare, work, and identity-provider pages.
Also read how to tell if an extension is safe.