Is Passwords & Sessions Manager safe?

Passwords & Sessions Manager stores its vault's PIN-derived master key alongside the encrypted passwords it protects.

When you set a PIN, the extension derives a key from it and saves that derived key in its own local browser storage instead of asking you to re-enter the PIN later. Every time it encrypts or decrypts a saved password or session cookie, it reads that same stored key back out automatically. Because the key and the encrypted data sit in the same unprotected local store, anyone able to read that store can decrypt the vault without ever knowing the actual PIN.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.