Summary
Auto login is a browser-side auto-fill tool. You save login entries (domain, username, password) for websites you choose; the extension auto-fills the login form when you visit an authorized site. All credentials are stored on your own machine, encrypted with AES-GCM-256 (on first install the vault is created automatically with the initial password 123456, which you can change at any time). The extension contains no networking code and transmits nothing anywhere.
1. Data We Collect
We only handle data you enter yourself, and it never leaves your device.
| Data type | Collected | Source | Purpose |
|---|---|---|---|
| Login entries (domain / URL match rules, username, password, alias) | Yes | You type them into the side panel, or generate them in bulk via "import from bookmarks" | Core function: auto-fill login forms (single purpose) |
| Environment info (environment names and config groups) | Yes | You create environments in the UI | Multi-environment config management |
| Settings (enabled state, per-domain captcha recognition switch, plus fill delay and selectors kept from older configs) | Yes | You configure them | Control fill behavior |
| Auto-submit failure counters | Yes | Generated by the extension at runtime | Prevents account lockout from repeated auto-submits (local counter only) |
| Browser bookmarks | Yes (only when you click "import from bookmarks") | Chrome bookmarks API | Read bookmarks only when you explicitly trigger the import |
Explicitly not collected:
- No network requests: the extension contains no code that sends data to any server (no
XMLHttpRequest/WebSocket/sendBeacon; everyfetchcall reads only local resources bundled inside the extension fromchrome-extension://— the captcha model and charset, UI language catalogs and icons — which never touches the network) - No analytics, no crash reporting, no ads; no third-party SDK that phones home or collects telemetry (the optional captcha recognition uses the open-source
onnxruntime-weband a captcha model bundled locally, running entirely offline) - No browsing history is collected, stored, or uploaded: the
tabspermission is used only to read the current active tab's address and title so "fill current domain" can prefill the URL; this metadata is used transiently on-device and never written to storage or transmitted - No device identifiers, location, contacts, or payment information
2. Where Data Is Stored
| Data | Location | Notes |
|---|---|---|
| Domain configs, usernames, passwords, environments | chrome.storage.local | Stored as AES-GCM-256 ciphertext (the vault is created on first install with the initial password) |
| Decrypted configs while unlocked | chrome.storage.session | In-memory only; cleared when the browser closes; auto-locks once system inactivity reaches the user's threshold (default 15 minutes) |
| System idle state (active / idle / locked) | Not stored, not uploaded | Read live via chrome.idle only to decide when to auto-lock; no keystroke, mouse or other-application data is collected |
| Encryption key handle | Extension-owned IndexedDB | A non-extractable key object; raw key bytes cannot be read out |
| Login failure counters | chrome.storage.local | Non-sensitive; used only to throttle repeated auto-submits |
| Interface language preference, auto-lock interval and similar settings | chrome.storage.local | Non-sensitive; used only for local display and auto-lock, never uploaded, and kept when Reset Password rebuilds the vault |
The master password itself is never written to any storage. It is only used to derive the encryption key.
3. Encryption
- Key derivation: PBKDF2-SHA256 with a random salt (200,000 iterations for the master password; 100,000 for exported file passwords)
- Data encryption: AES-GCM-256 (authenticated encryption with integrity checks)
- Key property: non-extractable —
exportKey()fails by design
If you forget your master password, the data cannot be recovered. That is an inherent property of the encryption design. The only way forward is Settings → Reset Password: it deletes all local data (environments, account configs, unsaved drafts) and rebuilds an empty vault with the initial password; the deleted data cannot be restored.
4. Permissions (mapped 1:1 to the declared permissions)
| Permission | Purpose |
|---|---|
storage | Save encrypted configs (storage.local) and unlocked session data (storage.session) |
activeTab | Temporary script-injection access to the active tab when you click the extension icon, for "fill current page" |
tabs | Read the active tab's address and title for "fill current domain" and alias matching; metadata only — browsing history is not collected, stored, or uploaded |
scripting | Inject the fill script on demand |
sidePanel | Render the side panel UI |
bookmarks | Read bookmarks only when you click "import from bookmarks", to generate domain configs in bulk |
idle | Read the system idle state so the extension can lock itself once inactivity reaches the interval you chose (clears in-memory plaintext and the key handle) |
alarms | A once-per-minute fallback check of the idle state, so the auto-lock is not missed when the service worker is torn down |
offscreen | Only when you enable "auto-detect and fill captcha" for a domain: creates an offscreen document to run the recognition model (WASM) locally; issues no network requests |
Site access is minimal by design: the extension does not request any install-time access to all websites (the manifest only declares optional_host_permissions: ["*://*/*"]). You are asked once, when you save a config for a domain, whether to allow access to that site. No extension script runs on sites you have not authorized. You can revoke grants at any time from chrome://extensions; revoked sites simply stop auto-filling (manual fill still works).
No forced content injection: the manifest declares no content_scripts. The extension never injects scripts into any page without your authorization; fill scripts are injected on demand only on authorized sites or when you trigger fill manually.
5. Export and Deletion
- Export is always user-initiated; optional file-password encryption is available
- Delete individual entries in the side panel
- Delete everything by uninstalling the extension or clearing its storage data
6. Third Parties
None. The extension does not share data with any third party because it does not transmit data anywhere; no data selling, no ads, no cross-site tracking.
7. Policy Changes
Material changes will be reflected in the "Last updated" date at the top of this document and shipped with a new extension version. Changes to data handling practices will be proactively disclosed as required by Chrome Web Store policy.
8. Contact
- Support / feedback: chenxuanvictory@163.com
- Project home: http://218.61.196.156:41695/Chrome-extension/auto-login
For privacy-related questions, please contact us through the channels above; we will respond within a reasonable timeframe.