Is IDX Password Manager safe?

IDX Password Manager wraps vault data with one hardcoded AES key, and can autofill credentials into any page from its URL parameters.

When you type your master password, the extension wraps it (and other vault fields) in AES encryption before sending it to the vendor's servers, but the AES key is a fixed string built into every copy of the extension, so anyone who can see the encrypted traffic can also decrypt it. Separately, on every website you visit the extension watches the page's URL for special autofill parameters; if present, it decodes a username and password from them and fills those values straight into the page's login form, without checking that the site itself put those parameters there.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.