Why Your Browser Extension Should Never See Your Passwords: A Guide to Extension Privacy

Why extensions need broad permissions at all

A grammar-checking or text-expander extension needs to work on any website you type on — that's the whole point. To do that, it has to request access to run on all sites ("host permissions"), which sounds alarming out of context but is genuinely necessary for the feature to work at all. The question isn't whether an extension requests broad access — most useful ones do — it's what it actually does with that access.

What a well-behaved extension does with page access

• Reads only the specific text field you're actively interacting with — not the whole page's content, and not other tabs.
• Only reads that text when you take an explicit action (like clicking a correction icon), not continuously in the background.
• Never reads password fields, since there's no legitimate reason a grammar tool would need to.
• Sends your text only to the specific service it's supposed to (an AI API, for example) — not to some other undisclosed server.

Red flags worth checking for

• Vague or missing privacy policy. If you can't find a clear, specific explanation of what data is collected and where it goes, that's worth pausing on.
• Permissions that don't match the stated function. A grammar checker asking for access to your browsing history or bookmarks has no obvious reason to need that.
• No way to see or control what's stored. A trustworthy extension's settings page should let you see and clear whatever it's storing about you.
• Undisclosed ads or trackers. Some free extensions monetize by injecting tracking scripts into every page you visit — a practice serious extension platforms explicitly prohibit, but that still shows up in low-quality extensions.

How to actually check before installing

1. Read the requested permissions listed on the extension's store page — not just the star rating.
2. Open the linked privacy policy and check whether it specifically explains what happens to your typed text, not just generic legal boilerplate.
3. Check whether the developer is identifiable (a real company or named developer, not an anonymous listing).

What "local-only" storage actually means

Some extensions store your settings and data only in your browser's local storage, meaning it never leaves your device unless the extension explicitly sends it somewhere for a specific feature (like sending text to an AI API you've configured). This is a meaningfully different privacy model than an extension that syncs everything to its own servers by default — worth checking for specifically if privacy matters to you.