Chrome Web Store
154Versions
1Code reviewed

No malware found

In code review (v2.11.55)

Our reviewer read version 2.11.55 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Clockify Time Tracker, used by 300,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

Analyst notes

The extension is a well-known time tracker from a trusted publisher. All network requests go to the publisher's own domain ([domain withheld]), and the data collected (PII, auth tokens, website content) matches the CWS-disclosed data categories. Permissions like scripting, tabs, and host_permissions are necessary for injecting timer buttons on integrated websites, as explained in the description. No code obfuscation or covert data exfiltration was found. The risk-engine's critical rating stems from broad permissions, not actual malicious behavior.

Clockify Time Tracker

Clockify Time Tracker Chrome extension security report

ID: pmjeegjhjdlccodhacdgbgfagbpmccpe

Supported Languages

🇺🇸English
🇫🇷French
🇩🇪German
🇪🇸Spanish

Extension Info & Metadata

Status
Active
Version
2.12.11
Size
1.42 MB
Rating
3.6/5
Reviews
208
Users
300,000
Type
Extension
Updated
Sep 27, 2026
Category
Productivity Workflow
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
Yes
This publisherTrack record
1extension
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
https://clockify.me/
Country
US
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Address
2100 Geng Rd STE 210 Palo Alto, CA 94303-3307 US
Website
Visit
Extensions
1
Active
1
Obsolete
0
Listed
1
Unlisted
0
Users
300,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
identity
Permission
High
This permission accesses Chrome identity service and user information. Rated High because it can obtain OAuth tokens, access connected accounts, and impersonate the user in authenticated service.
background
Permission
Medium
This permission allows continuous background operation. Rated Medium because it can perform actions without user awareness, consume system resources, and maintain persistent connections.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
*://*/
Host
Medium
Host permission — access limited to this URL pattern.
*://*.clockify.me/*
Host
Medium
Host permission — access limited to this URL pattern.
contextMenus
Permission
Low
This permission adds items to browser context menus. Rated Medium because it only modifies right-click menus without access to page content.
idle
Permission
Low
This permission detects system idle state. Rated Low because it only observes user activity state without access to activity details.
notifications
Permission
Low
This permission displays system notifications. Rated Low because it can only show user-visible notifications without accessing system data.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

About this extension

Track time from anywhere on the web and improve productivity.

Read the publisher’s full description

Track time from anywhere on the web with one click. Later, analyze and export time at https://clockify.me/reports/summary FEATURES • Integrates with 50+ web apps • Idle detection • Reminders • Pomodoro timer • Automatically start/stop timer • Start a timer from selected text • Start/stop timer shortcut (Ctrl+Shift+U) • Default project for new time entries Q: Why does the extension need access to "read and change all your data on the websites you visit"? A: We use the "Read and change all your data on the websites you visit" permission only for putting a timer button on other websites and taking the task's names as a description for the timer. If you don't wish to see the button on other websites, you can disable it in extension's Settings>Integrations. The code for this extension is open source. Feel free to examine it and contribute on Github: https://github.com/clockify/browser-extension For more information on how Clockify works, check out our help article https://clockify.me/help/apps/chrome-extension If you have any issues or feedback, send us an email at support@clockify.com ABOUT CLOCKIFY Clockify is a time tracker that allows you to track the time you spend on projects and analyze your productivity. You can use Clockify on the web, desktop, and mobile – all your tracked data is synced in real time so you can seamlessly switch between devices. - Free and simple online timer - Analyze time in reports and export data - Invite team and track time together - Manage projects and monitor progress

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
2.12.11
Latest
1.42 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.12.10
1.42 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.12.9
1.39 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.12.8
1.39 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.12.7
1.38 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.11.44
1.44 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.11.45
1.44 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.11.54
1.41 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.12.2
1.44 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
2.12.6
1.38 MBNot scanned—
2919bdb2a4ee1d20a33c72540042c870ab2d9a39de654d36825b691b5bc6641a
Showing 1 to 10 of 160 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Popular in productivity/workflow