Account Password Helper 浏览器扩展 Account Password Helper Browser Extension
最后更新：2026年10月27日 · 生效日期：2026年10月27日 Last updated: October 27, 2026 · Effective: October 27, 2026核心承诺：账号、密码、URL、备注、TOTP 密钥与个人信息逐字段加密后只写入您本机的浏览器存储，不上传任何服务器；本扩展的全部网络行为只有第 4 节列出的两类匿名请求。本政策另逐节说明了数据保留与删除的具体路径（第 8 节）、我们采取的安全措施（第 9 节）、每一类数据的使用目的与单一用途（第 10 节）、不出售不共享不转移（第 11 节），以及 GDPR / CCPA 等法规下您的权利如何行使（第 12 节）。
Account Password Helper（以下简称"本扩展"）是一款开源的 Chrome 浏览器扩展，用于管理和自动填充账号密码。本隐私政策说明我们如何收集、使用和保护您的信息。
本扩展的源代码完全开源，您可以在 GitHub 上查阅和审计所有代码。
本扩展不收集、不接收、也不传输您的任何个人数据。您录入的账号、密码、URL、备注、TOTP 密钥与个人信息，自始至终只在您自己的设备上被处理；我们之所以能这样承诺，是因为本扩展没有任何自有服务器，也没有任何数据上报通道——不存在一个「我们这边」可以存放您的数据的地方。具体来说：
所有数据仅存储在您的本地浏览器中（使用 Chrome Storage Local API），不会同步到云端或任何远程服务器。
敏感数据（用户名、密码、URL、备注、两步验证码密钥）逐字段使用以下方式加密：
主密码不以原文或可逆密文保存，其校验使用加盐的 PBKDF2（SHA-256，600,000 次迭代）校验值。
可选离线恢复：默认不启用、没有自动迁移。在「安全设置 → 离线恢复密钥」输入当前主密码可创建、换发或停用；创建和换发须先保存并回填验证套件，成功后才启用。 恢复密钥 R 由 32 随机字节生成，经 HKDF-SHA256 域分离派生不可导出的 AES-GCM 包裹钥 KEK，用当前主密码配置作 AAD 绑定数据钥 DK。 恢复功能仅在本机持久化包裹 DK 与非敏感元数据，不保存 R 或 KEK。此恢复包独立于会话，锁定或过期不会将其停用；它不新增网络请求、权限或遥测，既有匿名版本检查不变。
恢复套件不是备份：.aphrecovery 仅含恢复密钥、套件标识、版本和时间，不含密码库，请与设备和数据备份分开保管。
创建、换发或停用都不是备份；持有旧 R
与匹配旧恢复包/密文的人，不会因为您换发或停用而失去已复制数据的访问能力。怀疑泄漏时应修改主密码轮换数据钥，但历史副本无法收回。
已启用者正常改主密码也须先保存并验证新套件，成功后旧 R
不再适用于当前本机入口；未启用者保留原改密交互。若密码或回收站里有记录解不开，改密默认整笔中止；中止后可在明确知情下携带这些记录继续，但新主密码无法读取它们。
恢复套件是未加密的明文：.aphrecovery 内含恢复密钥；
拿到它并取得这台电脑的库数据即可解密，泄露后果等同于第二把万能钥匙。请与设备和数据备份分开保管，
不要留在下载目录，也不要经邮件或网盘传递；换发后请删除旧套件。
请这样理解「保持登录」：会话有效期内，用于恢复登录状态的密钥材料（数据密钥的包装值与包裹密钥）会随密文一起留在本机磁盘上， 这既是不重新输入主密码就能重启浏览器的原因，也意味着能读取这台电脑上该浏览器配置文件的程序，在此期间足以把数据解密。 手动锁定、闲置锁定或会话过期都会立即销毁这份密钥材料（只留一枚打不开任何东西的随机包裹密钥）。在共用电脑上，请在「自动锁定设置」中开启「浏览器重启锁定」： 完全关闭浏览器后密钥材料即被清除，重新打开必须输入主密码。
明文例外之一（到期提醒的账号名）：为某条密码设置到期提醒时，该条的账号名会以明文冗余记录在本地的到期提醒表中（提醒由系统在任意时刻发出桌面通知， 含已锁定状态，账号名用于让通知指明是哪个账号），它同时会留下「哪个账号将在何时到期」这一信息；删除该条提醒、删除对应条目或清空回收站都会连带清除这条明文记录。
明文例外之二（主密码提示语）：设置主密码时您可以自愿留一句提示语，它以明文保存在本机的
master_password_config
里，用途是在您忘记主密码、连续输错几次后帮自己回想——用主密码加密它就等于「忘了才需要看、看了却解不开」，因此明文是这项功能的前提而非疏漏。
提示语不参与任何密钥派生，也不包含主密码材料；它只是帮您回想，不构成找回机制。建议不要写入主密码本身或其变形，共用电脑上请勿设置，或只写只有您能解读的间接线索。
个人信息（姓名、证件号、手机号、邮箱、住址、银行卡信息与自定义字段）单独成库，整块以 AES-256-GCM 认证加密后写入本地存储，默认掩码显示；打开该库是否要求验证主密码由「个人信息库复验设置」决定（默认同一管理页会话内只问一次，锁定、会话过期或刷新、重开管理页后会重新问），库内的查看与复制不再额外索要主密码。 从网页输入框右键「从个人信息库选择」进入该库时，该菜单项不读取右键目标与字段内容、不预填检索词、不把库内的值回填页面，跨上下文只传递一个由浏览器盖章的来源标签页编号（一个整数，不含页面地址、不含字段内容、不含任何库内数据），用途是在库内给出「回到原网页」出口；这个编号不落盘，切回前还会复核来源页是否仍在原站点，不符即作废该出口。页面字段提示气泡上的同名按钮会额外带一个可选检索词：只在您点下按钮的那一刻读一次，取同一表单里判定为本人姓名那个框的值，或该格的标签文字，读完即用——不落盘、不进日志、不参与解密。两条入口都仍要过原有的主密码复验门槛，库内的值只由你逐字段或整卡经剪贴板限时清除通道复制。
本扩展仅进行以下两类网络请求，二者均不携带任何用户数据：
除此之外，本扩展不进行任何其他网络通信。密码的导入/导出、邮件备份提醒均为本地操作。
本扩展使用以下 Chrome 权限，每项均有明确的功能用途：
| 权限 | 用途 |
|---|---|
| storage | 在本地浏览器中存储加密后的密码数据、个人信息和用户设置 |
| activeTab | 在当前标签页中检测登录表单并执行自动填充 |
| scripting | 向网页注入表单检测和自动填充脚本 |
| sidePanel | 提供侧边栏面板用于管理密码 |
| alarms | 定时检查版本更新、自动备份提醒和 Service Worker 常驻保活（后台约每 20 秒唤醒一次，用于保证侧边栏秒开） |
| notifications | 发送版本更新和备份提醒通知 |
| idle | 检测用户空闲状态以实现自动锁定 |
| clipboardWrite | 复制密码到剪贴板并自动清除 |
| clipboardRead | 读取剪贴板以验证自动清除前内容未被替换 |
| webNavigation | 监听页面导航事件以优化表单检测时机 |
| contextMenus | 在网页右键菜单中提供填充入口（填充用户名/密码/两步验证码、生成强密码、打开侧边栏或管理页），以及「从个人信息库选择」——该项只做跳转：不读取右键目标与字段内容、不预填检索词、不把库内的值回填页面，个人信息始终留在管理页内由你逐字段复制 |
| favicon | 读取 Chrome 本地图标缓存（_favicon/ 端点），在密码列表与侧边栏展示站点图标，零外部网络请求 |
| <all_urls>（host） | 在任意网站上检测登录表单并提供自动填充功能 |
本扩展在运行时不使用任何第三方服务、CDN 或外部脚本。所有代码均打包在扩展内部运行，内容安全策略（CSP）限制为仅允许加载自身资源（script-src 'self'; object-src 'self'）。
本扩展提供多种本地数据导出方式：
保留位置与期限：您的全部数据只保存在本机的
chrome.storage.local
中，保留到您主动删除它们或卸载本扩展为止。我们没有任何服务端副本、日志、数据库或远程备份——因此不存在「请你们那边删掉」这种请求的对象；删除动作全部发生在您自己的设备上。
您可以使用的删除路径：
.aph / .aphid，再到另一设备或独立浏览器 Profile
导入核对，最后才考虑清除原库，不能先清再试。
两种独立备份格式不变，仍需导出时的主密码，新恢复密钥不能解开旧备份；若导出时与当前是同一密码且已遗忘，旧备份仍打不开。明文
CSV / JSON 导出也是数据来源。
没有可用恢复密钥或可解备份时仍无法恢复，最后的「重置所有数据」经二次确认后清空本机库且不可撤销。数据或
Profile 丢失时，仅有恢复密钥无用，仍需匹配数据备份；也不能事后给锁死库补恢复
chrome.storage.local 中的数据
您导出的文件（CSV / JSON /
.aph / .aphid / .aphrecovery
/站点规则
JSON）离开扩展后就归您所有，删除只能在您存放它们的位置进行；其中明文形态的文件包含可直接读取的凭据，请按第 7
节的提示妥善保管。
clipboardRead 权限的唯一用途）
script-src 'self'; object-src 'self'，不加载远程代码；权限取最小集合且逐项标注用途（第 5
节）；页面 DOM、导入文件与运行时消息一律按不可信输入做类型、长度与来源校验
本扩展的用途是单一的：在您本机安全地保存账号凭据，并替您在自己的网站上完成填充与登录辅助。每一类被经手的信息只服务于这条链路上的一个目的：
明确不做用途之外的处理：不用于广告投放或用户画像，不用于训练任何模型，不出售、不共享（第 11 节），也不与第 4 节之外的任何系统或第三方交换数据。
我们不出售、不出租、不以物易物，也不以任何方式向第三方共享或转移您的个人数据或凭据信息；不使用广告网络、数据经纪商或分析服务商；不把数据托管到任何云存储服务。由于没有任何数据离开您的设备，也就不存在云服务提供商访问、跨境转移或第三方执法调取数据副本的情形——没有可被调取的副本。本扩展不在任何意义上是您的数据的管理者或中间人。
因为我们不接收、不持有也不传输您的任何个人数据，本扩展的开发者不担任任何个人数据的控制者或处理者。GDPR、CCPA/CPRA 等法规赋予的访问、更正、删除、可携带、退出「出售」或「共享」等权利，在这里都对应一个更简单的动作：本机数据由您直接删除，或卸载扩展（见第 8 节），无需向我们提出请求，也无需等待响应。
如果您仍希望就隐私事项联系开发者（例如所在组织的合规审查需要书面说明），请使用第 15 节的联系方式；我们会按适用法律予以响应。
本扩展不会有意收集任何用户（包括 13 岁以下儿童）的个人信息。所有数据仅存储在用户本地设备上。
如本隐私政策有任何变更，将在本页面更新并标注变更日期。重大变更将通过扩展内通知提示用户。
如对本隐私政策有任何疑问，请通过以下方式联系：
Core Commitment: Account names, passwords, URLs, notes, TOTP secrets and personal info fields are encrypted field by field and written only to your browser's local storage — never uploaded to any server. All network activity this extension performs is limited to the two anonymous requests listed in Section 4. This policy also sets out, section by section: how long data is retained and every path you can use to delete it (Section 8), the security measures we take (Section 9), the purpose of use for each category of information and our single-purpose commitment (Section 10), that we do not sell, share or transfer anything (Section 11), and how you exercise your rights under GDPR, CCPA and similar laws (Section 12).
Account Password Helper (hereafter "the Extension") is an open-source Chrome browser extension for managing and auto-filling account credentials. This Privacy Policy explains how we collect, use, and protect your information.
The Extension's source code is fully open-source. You can review and audit all code on GitHub.
The Extension does not collect, receive, or transmit any of your personal data. The account names, passwords, URLs, notes, TOTP secrets and personal info fields you enter are processed exclusively on your own device. We can make that commitment because the Extension has no servers of its own and no data-reporting channel — there is no "our side" where your data could ever end up. Specifically:
All data is stored exclusively in your local browser (via Chrome Storage Local API) and is never synced to the cloud or any remote server.
Sensitive data (usernames, passwords, URLs, remarks, TOTP secrets) is encrypted field by field with the following:
The master password is never stored as plaintext or reversible ciphertext. Verification uses a salted PBKDF2 (SHA-256, 600,000 iterations) verifier.
Optional offline recovery: off by default, with no automatic migration. Under Security Settings → Offline Recovery Key, enter the current master password to create, replace or disable it. Creation and replacement require saving and re-entering the kit for verification before activation. Recovery key R is generated from 32 random bytes. Domain-separated HKDF-SHA256 derives a non-exportable AES-GCM wrapping key KEK; the current master-password configuration is AAD binding the data key DK. Recovery persists only wrapped DK and non-sensitive metadata locally, never R or KEK. This envelope is separate from the session and is not disabled on lock or expiry. Recovery adds no requests, permissions or telemetry; existing anonymous version checks remain.
A recovery kit is not a backup: .aphrecovery contains only the recovery key,
kit ID, version and time, not the vault. Keep it separate from the device and data backups. Creating,
replacing or disabling recovery is not a backup. Anyone with old R and its matching old envelope/ciphertext
retains access to those copied data even after replacement or disabling. If exposure is suspected, change
the master password to rotate the data key; historical copies cannot be recalled. Ordinary password changes
with recovery enabled also require saving and verifying a new kit first; after success old R no longer works
at the current local entry point. Users without recovery keep the original password-change interaction.
What "stay signed in" really means: while a session is valid, the key material that restores it (the wrapped data key and its wrap key) stays on this device's disk alongside the ciphertext. That is why a browser restart needs no master password — and it also means any program able to read this browser profile on this machine can decrypt your data during that window. Manual lock, idle lock and session expiry destroy that key material immediately (leaving a random wrap key that opens nothing). On a shared computer, turn on "Lock on browser restart" under Auto lock settings: fully closing the browser then clears the key material, and reopening requires the master password.
Plaintext exception 1 (expiry-reminder account names): when you set an expiry reminder for an entry, that entry's username is redundantly recorded in plaintext in the local reminder table, because reminders fire as desktop notifications at any moment — including while locked — and the username is what makes the notice name an account. It also leaves behind which account is expiring and when. Deleting that reminder, deleting the entry, or emptying the trash clears the record.
Plaintext exception 2 (the master password hint): you may optionally leave a hint when
setting the master password. It is stored in plain text in
master_password_config on this machine so that it can still be read after you forget the
password — encrypting it with that password would make it useless exactly when it is needed, so plaintext is
the feature's premise rather than an oversight. The hint takes no part in key derivation and contains no
password material; it only helps you recall, and it is not a recovery mechanism. Do not put
the master password itself or a variation of it in the hint, and on shared computers either leave it empty
or write only an indirect cue only you can decode.
Personal information (name, ID number, phone, email, address, bank card details and custom fields) is kept in a separate vault, stored locally only as one AES-256-GCM authenticated-encrypted blob; it is masked by default, and whether opening that vault asks for the master password follows a configurable policy (once per manager-page session by default) — viewing or copying inside an already opened vault asks nothing further. Opening that vault from a web page through the right-click item "Pick from Personal Info Vault" does not read the field under the cursor or any page content, prefills nothing and never writes a vault value back into the page; the only thing that crosses contexts is a source tab number stamped by the browser itself (an integer — no page address, no field content, no vault data) used to offer a "Back to the page" exit inside the dialog. That number is never persisted, and the origin is re-checked against the page you came from immediately before switching — if it no longer matches, the exit is voided. The identically named button on the in-page field hint carries one extra optional search term, read once at the moment you click it — the value of the field judged to be your own name in that same form, or the label of that field — and used and discarded there: never stored, never logged, never involved in decryption. Either route still passes the existing master-password verification gate, and values leave the vault only through your own per-field or whole-card copy under the timed clipboard wipe.
The Extension makes only the two requests below, and neither one carries any user data:
No other network communication occurs. Password import/export and email backup reminders are all local operations.
The Extension uses the following Chrome permissions, each with a specific functional purpose:
| Permission | Purpose |
|---|---|
| storage | Store encrypted password data, personal information and user settings locally |
| activeTab | Detect login forms and perform auto-fill on the current tab |
| scripting | Inject form detection and auto-fill scripts into web pages |
| sidePanel | Provide a side panel for password management |
| alarms | Schedule version update checks, auto-backup reminders, and always-on Service Worker keepalive (background wakeup roughly every 20 seconds to keep the side panel instantly available) |
| notifications | Send version update and backup reminder notifications |
| idle | Detect user idle state for auto-lock functionality |
| clipboardWrite | Copy passwords to clipboard with auto-clear |
| clipboardRead | Read clipboard to verify content hasn't been replaced before auto-clearing |
| webNavigation | Monitor page navigation events to optimize form detection timing |
| contextMenus | Provide fill entries in the page right-click menu (fill username/password/2FA code, generate a strong password, open the side panel or manager page), plus "Pick from Personal Info Vault" — that item only navigates: it reads no field content and no page content, prefills nothing and never writes a vault value back into the page; personal info stays on the manager page and is copied out by you, field by field |
| favicon | Read site icons from Chrome's local favicon cache (the _favicon/ endpoint) for password list and side panel entries — zero external network requests |
| <all_urls> (host) | Detect login forms and provide auto-fill on any website |
The Extension does not use any third-party services, CDNs, or external scripts at runtime. All code is bundled within the extension, and the Content Security Policy (CSP) restricts loading to self-only resources (script-src 'self'; object-src 'self').
The Extension provides several local data export options:
Where and how long: all of your data lives only in chrome.storage.local on
your own machine, and is retained until you delete it or uninstall the Extension. We keep no server-side
copy, log, database or remote backup of any kind — so there is no object for a "please delete it on your
side" request; every deletion happens on your device.
Deletion paths available to you:
.aph / .aphid read-only in the wizard, then import on
another device or in a separate browser profile to check the result before considering a wipe — never wipe
first and test later. Both independent backup formats are unchanged and still need their
export-time master password, not a new recovery key. If that was the same password now
forgotten, old backups remain unreadable. Plaintext CSV / JSON exports are another data source. With no
usable key or decryptable backup, data remains unrecoverable; the last-resort reset irreversibly clears
the local vault after confirmation. If data or the profile is lost, a recovery key alone is useless and a
matching data backup is still needed. Recovery cannot be added after lockout
chrome.storage.local
data when the extension is removed
Files you export (CSV / JSON /
.aph / .aphid / .aphrecovery
/ site-rule JSON) leave the Extension and become yours to keep; they can only be deleted wherever you store
them. Plaintext forms contain directly readable credentials, so handle them as Section 7 advises.
clipboardRead permission)
script-src 'self'; object-src 'self'
with no remote code; permissions are the minimal set, each with its purpose listed in Section 5; page DOM,
imported files and runtime messages are all treated as untrusted input and validated for type, length and
origin
The Extension has one purpose: to store your credentials securely on your machine and to help you fill and sign in on your own sites. Every category of information it handles serves exactly one step of that chain:
Nothing beyond that purpose: no advertising or user profiling, no training of any model, no sale or sharing (Section 11), and no data exchanged with any system or third party other than the two anonymous requests in Section 4.
We do not sell, rent, trade, or otherwise share or transfer your personal data or credentials with any third party; we use no ad networks, data brokers, or analytics providers; and your data is never hosted on any cloud storage service. Because no data leaves your device, there is no cloud-provider access, no cross-border transfer, and no copy that could be subpoenaed — there is nothing to subpoena. In no sense are we a custodian or intermediary of your data.
Since we neither receive, hold, nor transmit any of your personal data, the developer of this Extension acts as neither controller nor processor of any personal data. The rights granted by GDPR, CCPA/CPRA and similar laws — access, rectification, erasure, portability, opting out of "sale" or "sharing" — map here onto a single simpler action: you delete the local data directly, or uninstall the Extension (see Section 8), without filing a request with us or waiting for a response.
If you still wish to reach the developer about privacy matters (for example, your organisation's compliance review needs it in writing), use the contact details in Section 15; we will respond in line with applicable law.
The Extension does not knowingly collect personal information from any user, including children under 13. All data is stored only on the user's local device.
Any changes to this Privacy Policy will be updated on this page with the revised date. Significant changes will be communicated to users via in-extension notifications.
If you have any questions about this Privacy Policy, please contact us at: