alpass Chrome extension security report

alpass is a zero-knowledge password manager. Your vault is encrypted on your device with a key derived from your master password — so the server only ever holds ciphertext and can never read your passwords, your master password, or anything you save. WHY ALPASS • True zero-knowledge — your data is encrypted before it ever leaves your browser. Even the server operator cannot decrypt it. • Your master password never leaves your device. It is never sent, stored, or logged anywhere. • No silent surprises — autofill only happens when you ask for it. alpass never fills or submits forms on its own. FEATURES • One-click autofill — alpass detects the login fields on a page and fills the right credentials when you click Fill. • Save new logins — sign in somewhere new and alpass offers to save it, only after you confirm. • Built-in password generator — create strong, unique passwords with adjustable length and character sets. • Auto-lock — your vault locks itself after inactivity; unlocking re-derives your key in memory only. • Domain-safe matching — credentials are offered only on HTTPS sites whose registrable domain matches a saved item, so logins never leak to look-alike sites. STRONG, MODERN ENCRYPTION alpass uses Argon2id to derive your key and AES-256-GCM to encrypt each item — all in your browser. Every item is sealed with its own key. HOW IT WORKS Your master password is turned into two independent values on your device: a key that encrypts your vault (which never leaves your browser) and a verifier used only to prove who you are when logging in. The server stores just the verifier and your encrypted items. GETTING STARTED alpass connects to your alpass server. Create your account in the alpass web app, then log in here with the same email and master password. IMPORTANT There is no password recovery. Because your master password never leaves your device, nobody — including the server — can decrypt your vault if you forget it. Choose a strong master password you won't lose. This release supports Chromium-based browsers (Chrome, Edge).