Effective date: October 11, 2026
WebLatch Vault is a local password manager for Chrome and Edge. It saves login entries in an encrypted vault, imports RoboForm CSV exports that you select, lets you choose a saved account to fill on an HTTPS sign-in page, and offers user-confirmed Save or Update suggestions after supported form submissions.
Data handled
The vault can contain website addresses and origins, entry titles, usernames, passwords, notes, dates, and imported RoboForm metadata such as original URLs, MatchUrl, folders, and additional form fields. Imported additional fields are kept in the encrypted vault and are not used for autofill.
On HTTPS pages, the extension checks the page origin and login fields to show accounts saved for that exact origin. It does not keep a browsing-history log. If you choose Read current form, it reads visible login fields to create an entry. When you submit a supported sign-in, sign-up, or password-change form, it also reads the entered username and password to suggest saving a new account or updating a matching entry. It does not save or update an entry without your confirmation.
A RoboForm CSV file is read locally only after you select it. CSV exports can contain readable passwords. An encrypted JSON backup is read locally when you choose to restore it; exporting downloads an encrypted JSON file to your device.
Storage and use
The encrypted vault is stored in chrome.storage.local in this browser profile. It uses AES-256-GCM. Your master password derives a key with PBKDF2-HMAC-SHA-256, a random salt, and 600,000 iterations. The extension does not store the master password itself. It temporarily keeps an unlock key in extension session storage. To remember the vault on this browser, it keeps a wrapped vault key and a non-extractable cryptographic key in extension IndexedDB. Clicking Lock removes the remembered key and requires the master password next time.
A submitted credential awaiting your Save or Update choice is encrypted locally and kept in extension session storage for up to two minutes. The suggestion is limited to the originating HTTPS site and browser tab. Confirming writes the credential to the encrypted vault; dismissing or expiry removes the pending suggestion. The extension cannot verify whether the website accepted the login or password change, so review the suggestion before confirming.
WebLatch Vault has no developer-operated server, Chrome Sync, cloud account, analytics, advertising, or telemetry endpoint. It does not send your vault, master password, CSV contents, or browsing activity to the developer. The account chooser receives titles and usernames of entries matching the current HTTPS page. A password is retrieved for the page only after you select an account. Filling places the username and password into that website’s form. The website and its scripts can then read those values even before you submit the form. WebLatch Vault does not submit forms for you. If you copy a value, it is placed on the system clipboard, where other software with clipboard access may read it.
WebLatch Vault does not sell your data, use it for advertising, or share it with the developer or data brokers. A website receives a credential only through a fill action you choose. Exported files and copied values are under your control.
Retention and your choices
Vault entries remain in your browser profile until you edit or delete them, replace the vault by importing a backup, or remove the extension. Removing the extension clears its local extension storage under Chrome’s storage behavior. Downloaded CSV and backup files are separate files and remain until you delete them. Locking revokes the local remembered key and clears the current unlock session, but does not delete the encrypted vault. Before removing the extension or changing browser profiles, export an encrypted backup if you want to keep your entries.
Security limits
Anyone who can use the same unlocked browser profile may be able to reopen a remembered vault until you click Lock. Protect your device and browser profile. There is no developer-operated recovery service. Autofill supports matching HTTPS login forms in the main page. Check the site address before filling a credential. Save and Update prompts support standard HTTPS forms in the main page; some multi-step, iframe, shadow-DOM, or cross-origin sign-ins may require manual saving.
Chrome Web Store Limited Use
Use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including Limited Use requirements. Information is used only for these disclosed password-management features and is not used or transferred for personalized advertising.
This policy will be updated if the extension’s data practices change. The effective date above identifies this version.