Set password for your browser review: a startup password, but no relock

Who are you protecting the browser from?

Someone else sits down at your computer while you are still signed in to it. They do not know the startup password. What can they open?

What the password actually controls

Reopening saved URLs is not decrypting the Chrome profile. Version 9.1 controls tabs and windows. It does not encrypt Chrome's saved history, cookies or passwords with the extension password.

Does it keep the locked browser out of sight?

No. The password screen remains visible. It blocks ordinary browsing behind the prompt, but it does not hide that Chrome is locked.

A visible lock and keeping a private space out of sight are separate requirements.

What happens if the extension is disabled or removed?

With browser debugging enabled beforehand, version 9.1 was removed while its password page was active, without entering its password. After a normal restart, the extension was gone and the site was still signed in.

Normal attempts to open Chrome's extension manager from the locked browser were blocked. The successful removal used the already-enabled debugger to reach Chrome extension management, followed by Chrome's standard Remove dialog.

Chrome can impose separate enterprise policy that prevents users from modifying an extension. That administrative boundary comes from Chrome management, not from this extension password.

What does the startup password protect if the extension is not running?

Nothing extra in the saved Chrome profile. Version 9.1 does not encrypt Chrome's history, cookies or saved passwords with its password. Chrome and the operating system may still protect particular secrets in their own ways, but those protections do not come from this extension.

This does not mean every Chrome secret is plain text or that copying encrypted bytes reveals their contents. Chrome and the OS may separately protect particular secrets. For example, Chrome introduced App-Bound Encryption on Windows beginning with cookies in Chrome 127. Those protections are independent of this extension.

The browser checks used a history entry, saved site data and a login cookie. They establish what happened to those saved items; extracting saved passwords or reusing account cookies is a different question.

Would fixing every bug make its password protect the saved profile?

No—not by fixing the password screen alone. Fixes can make the startup lock more reliable, but protecting the saved profile after the extension stops requires a separate mechanism that protects the data itself.

An extension can be part of a larger system that protects browser data with a separate native app or encryption layer. Version 9.1 does not do that here: it controls Chrome windows and tabs. Making its password protect the saved profile would require a different data-protection layer, not just a better startup prompt.

Will I still be signed in after the startup password prompt?

The site stayed signed in after restarting the browser and entering the startup password. We returned to it without signing in again, and its saved site data was still present.

What happens to open tabs? The extension snapshot contains URLs, window IDs and tab indices. It is not a backup of live page memory or unsaved form state. There is also no relock after successful unlock.

Need to keep your accounts signed in on a shared computer?

If you need to keep accounts signed in while keeping other people out, compare browser-protection options for a shared computer.

If the space itself must stay out of ordinary view, see locking a profile versus hiding its existence.

Other weaknesses in version 9.1

The following are additional weaknesses in this version.

Evidence and limits of the review

All ten package files were read, including all three JavaScript files, both HTML entry pages and the manifest. The absence of profile encryption and independent access control follows from tracing all executable paths, not just from searching for permission names. Initial Node-based checks used mocked APIs to verify control flow; the browser experiments subsequently exercised the original scripts with non-sensitive data.

The browser experiments establish the stated behavior with active enforcement, the listed same-user capabilities and saved profile state. The completed production-ID management run covers foreground blocking, debugger-assisted disable/removal and the next normal restart. Claims about saved-password extraction, arbitrary websites, incognito behavior or universal tab restoration are outside these findings.

chrome.runtime.onStartup.addListener(async function () {
  chrome.storage.local.get(["key"], (result) => {
    //console.log('Value retrieved:', result.key);
    if (result.key) {
      closeAllTabs();

closedTabs = tabs
  .filter((tab) => tab.url !== chrome.runtime.getURL("options-1.html"))
  .filter((tab) => tab.url !== chrome.runtime.getURL("options.html"))
  .map((tab) => ({
    url: tab.url,
    windowId: tab.windowId,
    index: tab.index,
  }));

function save_options() {
  chrome.storage.local.get(["key"], (result) => {
    //console.log('Value retrieved:', result.key);
    var actual = result.key;
    var entered = document.getElementById("old").value;

    if (entered == actual) {
      chrome.runtime.sendMessage({ action: "removeListener" }, (response) => {
        if (response.success) {
          //console.log("Listener removed successfully.");
        }
      });

if (old == "" || newPassVal == "") {
  document.getElementById("note").style.display = "block";
  document.getElementById("note").innerHTML = "enter both fields";
} else if (newPassVal == old) {
  chrome.storage.local.set({ key: newPassVal }, () => {});
  document.getElementById("note").innerHTML = "password saved";
  document.getElementById("old").value = "";
  document.getElementById("new").value = "";
  document.getElementById("save").style.display = "none";

chrome.runtime.onMessage.addListener((message, sender, sendResponse) => {
  if (message.action === "removeListener") {
    if (activeListener) {
      reopenClosedTabs();
      chrome.tabs.onActivated.removeListener(activeListener);
      chrome.tabs.onUpdated.removeListener(onTabUpdated);
      //console.log('Listener removed');
      activeListener = null; // Clear the reference after removing
    }
    sendResponse({ success: true });
  }
});