Everything Nightlatch saves stays inside your own browser, using Chrome's built-in extension storage. Nothing is ever sent anywhere.
| Data | Where it is kept | Why |
|---|---|---|
| A salted hash of your password (PBKDF2-SHA256, 600,000 iterations) |
chrome.storage.sync — Chrome may replicate this between your own signed-in
browsers, under your own Google Account |
So the same password unlocks on each of your computers. The password itself is never stored and cannot be recovered from the hash. |
| Your preferences: auto-lock minutes, strict mode, lock-screen theme, list of protected hostnames | chrome.storage.sync |
So your settings are the same on each of your computers. |
| Whether this browser is currently locked | chrome.storage.session — in memory only, cleared when the browser closes,
never replicated |
This is deliberate: unlocking on one computer must never unlock another. |
| Per-computer switches and a count of failed unlock attempts | chrome.storage.local — this device only, never replicated |
To let you relax the timer on a private machine, and to tell you if someone tried a wrong password while you were away. |
| The last 20 times this profile locked, and the reason for each (screen lock, idle timeout, the keyboard shortcut, the toolbar button) |
chrome.storage.local — this device only, never replicated |
So a lock you did not expect can be explained afterwards, on the settings page. Times and reasons only: no page addresses, no page content, nothing about your password. |
Nightlatch requests access to all sites for one reason: while the profile is locked it must be
able to draw a covering lock screen over whatever page happens to be open. That code paints an
overlay and blocks input — it does not read page content, and there is nowhere for page content
to be sent even if it did. You can confirm this yourself: the source contains no
fetch, XMLHttpRequest or WebSocket calls.
Nightlatch is open source under the MIT licence. Every line the extension runs is published at github.com/yzoe236/nightlatch. Please read it before you type a password into it.
Removing the extension from chrome://extensions deletes everything it stored. There
is no copy anywhere else, because nothing was ever sent anywhere.
If this policy ever changes it will be updated on this page and in the repository's commit history, which is public and timestamped.
Questions or concerns: please open an issue at github.com/yzoe236/nightlatch/issues.