Password Auto Generator Privacy Policy

Prepared for version 1.2.0 · Last updated 11 October 2026

Password Auto Generator is published by Muhammad Qasim. It generates passwords locally and fills eligible signup password fields. This policy describes the extension's own processing. Websites where you use the extension have their own privacy policies.

Information the extension handles

To detect a supported signup form, Password Auto Generator examines password inputs and nearby form labels, headings, buttons and validation rules in permitted pages and frames. It preserves login inputs and existing or manually edited passwords. It does not submit forms.

For each generated password, encrypted recovery stores a creation ID, creation timestamp, the signup frame's hostname and origin, the detected username or email when available, and the generated password. It does not store the page's full URL, general browsing history or arbitrary page content. Detected usernames or emails are associated with a generated record; they are not saved as a separate contact database.

Your recovery master password is used locally during setup or unlock and is not stored. A derived encryption key is held in trusted Chrome session storage while recovery is unlocked.

Local storage and encryption

Recovery records, including passwords and their site/identity metadata, are encrypted with AES-256-GCM before persistent storage in chrome.storage.local. The key is derived from your master password with PBKDF2-SHA-256 using a random salt and 600,000 iterations. A fresh encryption IV is used for every rewrite. The persistent vault contains ciphertext and cryptographic parameters; it does not contain the master password or a plaintext decryption key.

Recovery locks when you press Lock, restart Chrome, reload/update the extension, or otherwise end its browser session. An ordinary extension service-worker restart within the same browser session retains the session unlock. Automatic filling pauses while recovery is locked or saving cannot be verified. The publisher cannot recover a forgotten master password.

When upgrading an earlier version that stored plaintext recent creations, the extension verifies an encrypted copy before removing the old plaintext array. Existing credentials are retained if conversion or verification fails. Conversion completes only after you set up or unlock encrypted recovery.

Retention and deletion

The popup shows the last 10 creations. Ordinary new saves retain up to 10 records; deletion removes the selected entry. If an older version contains more entries, migration preserves those credentials in encrypted form until the next ordinary new save applies the retention limit. Each regeneration is a new creation and can evict an older record.

You can delete individual records in the unlocked popup. Uninstalling the extension removes its extension storage. Losing your browser profile, profile corruption or storage failure may also remove recovery. Deletion is an application-level action; the extension cannot guarantee erasure from operating-system backups or disk remnants. Keep important credentials in your main password manager.

Clipboard and filled fields

After encrypted saving and filling, Password Auto Generator attempts to copy the generated password to the clipboard. Copying may be blocked by the browser; manual Copy controls are available while unlocked. The extension never reads the clipboard. It does not automatically clear the clipboard because that could replace something you copied later.

Passwords in a site's own input fields are accessible to that site. Clipboard managers, other applications, browser debugging tools or compromised device software may also access copied or unlocked data. Encryption at rest does not protect a compromised running browser or device.

Sharing, analytics and network access

The extension makes no network requests, sends no telemetry, includes no advertisements or remote code, and uses no cloud sync for its recovery records. The publisher does not receive passwords, detected identities or visited signup sites. This data is not sold or transferred to third parties or used for advertising, creditworthiness or purposes unrelated to the extension.

If you contact support by email, the publisher receives what you choose to send through the email service. Please do not send passwords, master passwords or recovery exports. The support website and email provider operate independently of the extension's local storage.

Permissions and supported contexts

Storage access supports encrypted recovery and the session unlock key. Clipboard-write access supports password copying. HTTPS site access supports automatic detection and filling in permitted pages, including related authentication frames. The extension does not run in incognito mode. Restricted browser pages and some frames or custom controls are unsupported.

Contact and policy changes

Publisher: Muhammad Qasim
Support: qasim@dentalinstrumentssupplier.com
Website: dentalinstrumentssupplier.com

If the extension's data practices change, this policy will be updated with a new date and the relevant extension release will disclose the change.