Token Counter Chrome extension security report

Token Counter is a fast, lightweight, and privacy-first browser extension that counts tokens, words, and characters on any webpage. It uses OpenAI's official GPT-4 tokenization algorithm (cl100k_base via tiktoken) to provide accurate token counts, helping you stay within context limits when working with large language models. Whether you are a writer optimizing a prompt, a developer debugging API token usage, a researcher analyzing text, or a student checking essay length — Token Counter gives you instant text statistics without leaving the page you are on. Key Features: • SELECT TEXT & COUNT — Highlight any text on a webpage and see the token, word, and character count appear instantly in the popup. No copy-pasting required. • FULL PAGE SCAN — Click "Scan Page" to analyze all visible text on the current page. Great for quickly estimating how much of an article, documentation page, or blog post fits into a model's context window. • ACCURATE TOKENIZATION — Built on top of OpenAI's tiktoken library with the cl100k_base encoding, the same algorithm used by GPT-4, GPT-3.5-turbo, and ChatGPT. Token counts match what the actual API would return. • REAL-TIME UPDATES — Counts update as you select different text on the page. No page reloads, no extra clicks. • PRIVACY FIRST — All text processing happens entirely in your browser. No data is ever sent to any server, logged, or tracked. Token Counter has no analytics, no telemetry, and no external network requests beyond what you explicitly navigate to. • CLEAN & MINIMAL UI — A simple, unobtrusive popup that shows exactly what you need: token count, word count, and character count. No clutter, no distractions. • FREE & OPEN SOURCE — No paywalls, no premium tiers, no account required. Just install and use. Use Cases: → PROMPT ENGINEERS — Count tokens in your prompts to fit GPT-4's 8K, 16K, or 128K context windows with precision. → DEVELOPERS — Debug token usage before making API calls. Verify that your text fits within model limits (OpenAI, Anthropic Claude, Llama, Mistral, etc.). → CONTENT WRITERS — Check article length in tokens, words, and characters. Optimize blog posts, social media captions, and marketing copy. → STUDENTS & RESEARCHERS — Quickly measure text length for assignments, abstracts, and submissions with word or character limits. → TRANSLATORS & LOCALIZERS — Compare source and target text lengths during translation to ensure consistency. → EVERYDAY USERS — Curious how many tokens a webpage, email, or article contains? Just select and see. Why Token Counter? There are many text counter tools out there, but most either send your data to a server, require copy-pasting text into a separate website, or use inaccurate counting methods. Token Counter is built different: • Works in-page — no switching tabs or pasting text • Uses real GPT-4 tokenization — not approximation • Runs entirely offline — your data stays yours • Zero configuration — install and it just works Tokenization Details: Token Counter uses the cl100k_base BPE (Byte-Pair Encoding) tokenizer, which is the same tokenizer used by: — GPT-4 — GPT-3.5-turbo — gpt-3.5-turbo-16k — ChatGPT — Azure OpenAI Service This means the token counts you see in Token Counter are identical to what OpenAI's API would report. One token is roughly 4 characters or 0.75 words on average in English, but actual counts vary by language and content. Note: Token Counter works on all standard web pages. For dynamically rendered content (e.g., single-page apps) or iframed elements, counts may vary depending on how the page loads text. Installation: 1. Click "Add to Chrome" on this page 2. Pin the extension to your toolbar for quick access 3. Navigate to any webpage, select text, and click the Token Counter icon Support & Feedback: If you encounter any issues or have suggestions for improvement, please reach out via the support link or leave a review. Token Counter is actively maintained and regularly updated. activeTab justification: To read text selected by the user on the current active tab and count tokens, words, and characters. The extension only accesses the active tab when the user explicitly clicks the extension icon or selects text. No background, cross-tab, or persistent access is required. contextMenus justification: To add a "Count Tokens" option to the browser's right-click context menu, allowing users to quickly count tokens without clicking the extension icon first. The menu appears only on text selections. host permission justification: To access and tokenize text content on any webpage that the user explicitly chooses to count text from. The extension does not run automatically on all sites. It activates only when the user clicks the extension icon or selects text. No user data is collected or transmitted. remote code justification: The extension does not load, download, or execute any remote code. All tokenization logic, including the cl100k_base encoding and tiktoken-based algorithm, is bundled locally within the extension package. No external scripts, WebAssembly modules, or code evaluations are fetched at runtime. scripting justification: To temporarily inject a lightweight content script into the active page that reads user-selected text and sends it back to the extension popup. The script is injected only when the user clicks the extension icon and is removed immediately after. No persistent scripts are installed on any page. single purpose description: Counts tokens, words, and characters from selected text on any webpage using OpenAI's GPT-4 tokenization algorithm. certification text (checkbox label): I certify that my data usage complies with our Developer Program Policies. optional paragraph for store listing description (add at the end of your existing description): Data Privacy & Security Token Counter processes all text entirely inside your browser. No selected text, no page content, no tokens, and no personal data are ever sent to any server — including OpenAI. The extension makes no external network requests, collects no analytics, and uses no telemetry. Everything stays on your device. Your data never leaves your computer. privacy policy text (if a policy URL is required, you can paste this into a plain text field if allowed): This extension collects no data. No privacy policy is required because no user data is ever transmitted, stored, or shared.