Subdomain Vault is a password manager that saves credentials per exact subdomain and encrypts them on your device. This page explains, plainly, what the extension does and doesn't do with your data.
Nothing leaves your device. There is no server, no account, and no sync — the extension has no backend to send data to.
No analytics or tracking. The extension doesn't load any third-party scripts or report usage anywhere.
Your master password is never stored. Only a one-way verification hash derived from it is kept, to confirm you typed it correctly.
You control the data. View, edit, or delete any saved credential from the dashboard at any time; uninstalling the extension erases everything.
When you save a credential, Subdomain Vault stores the following, encrypted, in your browser's local extension storage:
The site's address (origin — scheme, host, and port)
A label you choose for the credential (e.g. "User" or "Admin")
The username or email you entered
The password you entered
That's the complete list. The extension does not collect your browsing history, the contents of pages you visit, form data unrelated to logins, or any information about you as a person.
Every credential is encrypted with AES-256-GCM before it touches disk, using a key derived from your master password via PBKDF2 (300,000 iterations, SHA-256) with a random per-vault salt. The master password itself is never written to storage — only a verification hash used to confirm you entered it correctly.
If you turn on the optional auto-fill feature, the decryption key is kept in chrome.storage.session — memory only, never written to disk — for up to 15 minutes, or until you lock the vault or close the browser, whichever comes first.
Because everything is encrypted with a key derived from your master password, and that password is never stored, there is no password reset. If it's lost, the data can't be recovered — by you or anyone else.
Chrome requires every extension to declare what it can access. Here's what Subdomain Vault requests and what each one is used for:
What it's for
storage
Saves your encrypted vault and credentials locally, and your auto-fill preference.
unlimitedStorage
Removes the default browser storage quota so saving many credentials doesn't hit a limit.
activeTab
Lets the popup read the current tab's address and send a fill request to it — only when you open the popup.
Access to all sites
The extension needs to run a small script on pages you visit to detect login and password-change forms, and to fill in a credential when you ask it to (or, only if you've opted in, automatically). It never reads or transmits page content beyond looking for these form fields.
We don't operate a server. There is nowhere for your data to be sent.
We don't sell, rent, or share your data — there's none in our possession to share.
We don't use analytics, crash reporting, or any third-party tracking libraries.
We don't show ads.
We don't use or request access to your data for anything beyond the extension's stated purpose of saving and filling logins.
View, edit, or delete any credential from the dashboard, at any time.
Auto-fill is off by default. Turning it on requires your master password and shows an explicit explanation of what changes before it takes effect.
Lock the vault at any time to immediately discard the in-memory key.
Uninstalling the extension removes all of its stored data from your browser.
Subdomain Vault is not directed at children under 13, and we do not knowingly collect information from them — in practice, we don't collect information from anyone, of any age, since nothing leaves your device.
If this policy changes, the "last updated" date at the top of this page will change with it. Since the extension has no way to contact you, please check back here if you want to know what's changed.
Questions about this policy or the extension can be sent to kekanodev@gmail.com.
Subdomain Vault — a browser extension for per-subdomain credential management.