Chrome Web Store
92Versions
1Code reviewed

No malware found

In code review (v5.12.2)

Our reviewer read version 5.12.2 — the most recent version we have reviewed — and found no malicious behaviour. The version shown here has not been individually reviewed yet.

What our analysis found

Passbolt - Open source password manager, used by 300,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites and can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

The extension is a well-known open-source password manager (Passbolt). All permissions (broad host access, scripting, cookies, downloads, clipboardWrite, offscreen) are essential for its core functionality: autofilling credentials, managing sessions, passwords, copying to clipboard, and running headless operations. The source code is primarily minified React bundles for UI (login, account recovery, in-form CTA) and an offscreen handler for clipboard and fetch operations. No malicious patterns like covert data exfiltration, unauthorized data collection, or code injection were found. Data is sent only to the user's own Passbolt server (first-party). The ML model flagged this extension due to typical patterns in minified code (e.g., base64 encoding, large bundle size, broad permissions) that are not malicious in this context. The third-party risk score corroborates low likelihood of harm.

Passbolt - Open source password manager

Passbolt - Open source password manager Chrome extension security report

ID: didegimhafipceonhjepacocaffmoppf

Supported Languages

🇨🇿Czech
🇳🇱Dutch
🇺🇸English
🇫🇷French
🇩🇪German
🇮🇹Italian
🇯🇵Japanese
🇰🇷Korean
🇱🇹Lithuanian
🇵🇱Polish
🇷🇴Romanian
🇷🇺Russian
🇸🇮Slovenian
🇪🇸Spanish
🇸🇪Swedish
🇺🇦Ukrainian

Extension Info & Metadata

Status
Active
Version
5.16.0
Size
5.71 MB
Rating
4.2/5
Reviews
97
Users
300,000
Type
Extension
Updated
Sep 17, 2026
Category
Workflow & planning
Price
Free
Featured
Yes
Visibility
Listed
Mature
No
By Google
No
Trusted
No
This publisherTrack record
2extensions
All still listed
Scanned by Extension Auditor — Low RiskDevelopers: embed this badge to link to this report.

Publisher Contextual Analysis

Trusted
Author
Passbolt
Country
LU
MX records exist
Yes
Domain exists
Yes
Is disposable
No
Is role-based
Yes
Mailbox exists
Yes
Address
9 Av. du Blues Belvaux 4368 LU
Website
Visit
Extensions
2
Active
2
Obsolete
0
Listed
2
Unlisted
0
Users
442,142

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Screenshots & videos

Screenshot 1
Screenshot 2
Screenshot 3
Screenshot 4
Screenshot 5
Screenshot 6

Install growth

Item
Type
Severity
Description
scripting
Permission
Critical
This permission allows injection and execution of JavaScript on any webpage. Rated Critical because it can modify page content, steal sensitive data, and inject malicious code into any site the extension has access to.
*://*/*
Host
Critical
Broad host access — the extension can read/modify content on every website.
downloads
Permission
High
This permission controls file downloads and accesses download history. Rated High because it can download malicious files, access sensitive downloaded documents, and track user download patterns.
cookies
Permission
High
This permission provides full access to read and modify browser cookies. Rated High because it can steal session tokens, modify authentication cookies, and compromise accounts across websites.
clipboardWrite
Permission
High
This permission allows modification of clipboard content. Rated High because it can inject malicious content into the clipboard, modify copied passwords, and manipulate copied data.
offscreen
Permission
High
This permission creates hidden browser documents with full DOM access. Rated High because it can run background operations invisibly, potentially executing malicious code without user awareness.
Broad Host Permissions
Risk Factor
High
This extension has broad host permissions allowing it to access many or all websites.
Broad Content Script Access
Risk Factor
High
This extension can inject scripts into any website.
activeTab
Permission
Medium
This permission grants temporary access to the current tab. Rated Medium because it can access current page content when invoked, though limited to user-initiated actions.
unlimitedStorage
Permission
Medium
This permission removes storage quota restrictions. Rated Medium because it can store large amounts of user data without limits, potentially impacting browser performance and storing extensive tracking data.
storage
Permission
Medium
This permission allows storing data locally in the browser. Rated Medium because it can persist sensitive user data, track user activities over time, and potentially store malicious payloads.
tabs
Permission
Medium
This permission enables tab management and monitoring. Rated Medium because it can track open tabs, access tab metadata, and monitor user browsing patterns.
background
Permission
Medium
This permission allows continuous background operation. Rated Medium because it can perform actions without user awareness, consume system resources, and maintain persistent connections.
alarms
Permission
Low
This permission schedules periodic tasks. Rated Low because it can only trigger events at specified times without access to sensitive data.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

About this extension

Passbolt extension for the open source password manager for teams.

Read the publisher’s full description

Passbolt is an open source password manager designed for collaboration. You can securely generate, store, manage and monitor your team credentials. Get access to all of your logins and passwords from multiple browsers or even your mobile phone. Create strong random passwords, thanks to the fully customizable password generator, and share them instantly with your team. Passbolt is built on top of an open API made for developers and agile teams. Passbolt is extensible and yet usable by everyone. No technical knowledge is required to use it. This is why Passbolt is trusted by small businesses, as well as government offices, regulated industries, and privacy-conscious organizations: Boost collaboration & productivity: - Easily share one password, or a folder with a single user or a group of users; - Use personal or shared tags to identify passwords and secrets; - Give specific access rights to a user or group; - Get detailed reporting on access & change history. Security by design. Audited and certified: - True end-to-end encryption; - Interoperable cryptography based on OpenPGP; - Full control your own encryption key; - Access revocation that actually works; - Regularly audited by independent auditors. Made in Europe. 
Privacy by default: - Host it in our cloud, located in Europe; - Or self-host it for full data ownership; - No tracker, no strings attached. Passbolt source code comes under an AGPL license (yes even the commercial version) and is publicly available. You are free to audit it, contribute to it, or redistribute it. This add-on is required to use the software, in order to provide advanced security features as well as functionality such as password auto filling on web pages. Get started now: https://www.passbolt.com/cloud/signup Check the source code: https://github.com/passbolt

User reviews

Extension files

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No network indicators were extracted from this version.

Version
Size
Verdict
Findings
Permhash
5.16.0
Latest
5.71 MBNot scanned—
bdda706214b46880e2d184a7f6abc856828e37ace0edbf9cb5752ec2494f1667
5.15.1
5.63 MBNot scanned—
ab7e76a4f28c1d70770e4f5bd910adb1ae37fc9a9e00283dcaeb5d21416d9392
5.15.0
5.63 MBNot scanned—
ab7e76a4f28c1d70770e4f5bd910adb1ae37fc9a9e00283dcaeb5d21416d9392
5.12.0
5.26 MBNot scanned—
ab7e76a4f28c1d70770e4f5bd910adb1ae37fc9a9e00283dcaeb5d21416d9392
5.14.3
5.62 MBNot scanned—
95b21aa26c782c5848b604cb0dfd116e42fe793e3eac7b5cc641194644feefef
5.14.2
5.62 MBNot scanned—
bdda706214b46880e2d184a7f6abc856828e37ace0edbf9cb5752ec2494f1667
5.13.4
5.46 MBNot scanned—
bdda706214b46880e2d184a7f6abc856828e37ace0edbf9cb5752ec2494f1667
5.13.0
5.27 MBNot scanned—
bdda706214b46880e2d184a7f6abc856828e37ace0edbf9cb5752ec2494f1667
5.12.2
5.26 MBNo malware found0
bdda706214b46880e2d184a7f6abc856828e37ace0edbf9cb5752ec2494f1667
5.11.2
5.25 MBNot scanned—
bdda706214b46880e2d184a7f6abc856828e37ace0edbf9cb5752ec2494f1667
Showing 1 to 10 of 100 rows
Rows per page:

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

More from Passbolt

Popular in Workflow & Planning