CredentialBase Chrome extension security report

CredentialBase — Zero-Knowledge Password Manager Your passwords are yours. Not ours. CredentialBase encrypts everything on your device before it ever reaches our servers. We use AES-256-GCM encryption with keys derived from your master password — meaning even we cannot read your data. No backdoors. No exceptions. ─────────────────────────────────── 🔐 ZERO-KNOWLEDGE SECURITY ─────────────────────────────────── Every password, note, and card is encrypted client-side using AES-256-GCM before leaving your device. Your master password never touches our servers. We store only encrypted blobs we cannot read — even if our servers were compromised, your data stays safe. ─────────────────────────────────── ⚡ AUTOFILL IN ONE CLICK ─────────────────────────────────── CredentialBase detects login forms automatically as you browse. One click fills your username and password. Works on virtually every website including React, Vue, and Angular apps. Also autofills credit card details on checkout pages — card number, expiry, CVV, and name all at once. ─────────────────────────────────── 💳 CARD VAULT ─────────────────────────────────── Store your credit and debit cards securely alongside your passwords. Card numbers are validated, masked by default, and encrypted with the same AES-256-GCM standard. Tap to reveal. One-click copy for card number, expiry, CVV, and cardholder name — with automatic clipboard clearing after 30 seconds. ─────────────────────────────────── 🔗 SECURE CREDENTIAL SHARING ─────────────────────────────────── Share a login or card with anyone — even if they don't have an account. Each share link is encrypted with a unique one-time key that never reaches our servers (stored in the URL fragment). Set an expiry time, view limit, and optional PIN for extra protection. Revoke access any time. ─────────────────────────────────── 🔄 CROSS-DEVICE SYNC ─────────────────────────────────── Your encrypted vault syncs across all your devices in real time. Add a password on your desktop, use it on your laptop instantly. Everything stays encrypted end-to-end throughout the sync process. ─────────────────────────────────── 📝 SECURE NOTES ─────────────────────────────────── Store sensitive text — Wi-Fi passwords, recovery codes, PINs, private notes — with the same zero-knowledge encryption as your passwords. ─────────────────────────────────── 🆓 FREE TIER INCLUDED ─────────────────────────────────── Get started for free with up to 50 vault items and 3 active share links. Upgrade to Pro for unlimited items, unlimited sharing, and priority sync. ─────────────────────────────────── 🛡️ BUILT FOR PRIVACY ─────────────────────────────────── - AES-256-GCM encryption (military grade) - PBKDF2 key derivation (600,000 iterations) - Master password never sent to servers - Clipboard auto-clears after 30 seconds - Auto-lock on vault close - No tracking. No ads. No selling your data. ─────────────────────────────────── HOW IT WORKS ─────────────────────────────────── 1. Create an account with your email and a strong master password 2. Your master password derives two keys locally — one for authentication, one for encryption 3. All vault data is encrypted on your device before syncing 4. Only you can decrypt your vault — not us, not anyone else ─────────────────────────────────── PERMISSIONS EXPLAINED ─────────────────────────────────── - Read and change all your data on websites — required for autofill on login and payment forms - Storage — saves your encrypted session locally so you don't have to log in on every browser restart - Tabs — detects the current website to match saved credentials CredentialBase is open about what it does and why. We request only the permissions we need. ─────────────────────────────────── Start protecting your passwords the right way. Add CredentialBase to Chrome — it's free.