Password Forge — Privacy Policy

Last updated: September 2026

Password Forge is a Chrome extension that derives a password for a given website from a passphrase you type, using PBKDF2 (SHA-256) entirely on your own device. This page explains exactly what data the extension touches.

Data we never store or transmit

• Your master passphrase — exists only in the popup's memory while it is open, and is discarded the moment the popup closes. It is never written to disk, never sent anywhere.
• Any generated password — computed locally and shown to you; never stored or transmitted.

Data stored locally on your device only

Using the storage permission, the extension saves a small amount of non-sensitive preference data with chrome.storage.local, which never leaves your device and is never synced to any server we control:

• Your chosen default User ID (only if you explicitly click "save as default")
• Your preferred password length and character-type toggles
• Your chosen display language (English/Japanese)

Data read, but not stored

Using the activeTab permission, the extension reads the hostname of the tab that is active when you open the popup, solely to pre-fill the "Domain" field for your convenience. No other page content, browsing history, or tab data is accessed. This value is not stored or transmitted anywhere; it simply appears in the input field for you to use or edit.

No network requests

Password Forge makes no network requests of any kind. All computation (PBKDF2 key derivation) happens locally in your browser via the standard Web Crypto API. There are no analytics, no ads, no third-party scripts, and no remote code execution.

Data sharing

We do not share, sell, or transmit any data to third parties, because no data ever leaves your device in the first place.

Data deletion

Uninstalling the extension removes all locally stored preference data. You can also clear it at any time via chrome://extensions → Password Forge → Remove, or by clearing the extension's storage from Chrome's site data settings.

Changes to this policy

Any changes to this policy will be posted on this page.

Contact

Questions or concerns can be raised via the GitHub repository for this project.

この拡張機能は、あなたが入力した合言葉からPBKDF2(SHA-256)を用いてパスワードをすべて端末内で計算します。合言葉や生成されたパスワードは一切保存・送信されません。storage権限で保存されるのは既定のユーザーID・パスワード長・文字種設定・表示言語といった低機微度な設定のみで、外部への送信は一切行いません。activeTab権限は、ポップアップを開いた瞬間の現在のタブのホスト名を読み取り、ドメイン欄を自動入力するためだけに使用され、保存も送信もされません。