LLM Masker - PII & Secret Redactor Chrome extension security report

Secrets stop before Send. LLM Masker catches API keys, passwords, credit cards, national IDs, email addresses and phone numbers in the text you are about to submit to an AI chat, and replaces them with [REDACTED_BY_LLM_MASKER] before the message leaves your browser. It works inside the seven most-used AI chat websites — see the screenshots for the current list. 100% ON-DEVICE • Every check runs locally. Your prompts are never uploaded — not to us, not to anyone. • No account, no sign-up, no telemetry. • The free version makes zero network requests. Verify it yourself with DevTools → Network: nothing. WHEN IT STEPS IN • On paste — text is cleaned the moment it lands in the prompt box. • While typing — a secret is masked the instant it is complete (optional). • At send — a final pass on Enter or the send button. WHAT IT CATCHES About 95 detectors in 16 groups: • API keys and access tokens from AI, cloud, developer, payment and messaging services • Private keys and database connection strings that embed a password • Passwords and secrets written in code or config files • JWT tokens • Credit card numbers (Luhn-verified) and IBANs (checksum-verified) • National IDs, such as a US SSN or an Indian Aadhaar • Email addresses, phone numbers and, if you turn it on, public IP addresses Every detector is anchored to a known format, a checksum or surrounding context — never "any long random string" — so ordinary text, git hashes and code stay untouched. Each detector group can be switched on or off in Settings. WHAT YOU SEE • A popup with a master switch, your totals and recent activity — labels and timestamps only, never the values. • A dashboard with a 7-day chart and a breakdown by type, stored only in your browser. Clear it any time. OPTIONAL PRO UPGRADE • Custom rules — mask your own words and patterns, such as project codenames or customer IDs (plain text or regex, up to 50). • Allowlist — exact values that are safe and must never be masked. • Private audit log — 1,000 events for 12 months, per site, with JSON export. Still labels only, never the values. One licence code works on every browser you use. The only request the upgrade ever makes is a small daily licence check that contains no prompt content. The free tier is complete and permanent. PERMISSIONS, PLAINLY • Access to the supported AI chat sites — to read and rewrite the prompt box before submission. • Storage — your settings, counters and rules, on this device. • Offscreen document — runs the detectors off the page's main thread so typing stays smooth. • Alarms — the once-a-day licence check. Nothing else. Privacy policy: https://llmmasker.com/privacy How it works, for security teams: https://llmmasker.com/docs/security Help: https://llmmasker.com/support · support@llmmasker.com Made by ASL Digital Solutions.