Is Pi Lens - Notes, PYQs, Quizzes and more on Youtube safe?
Pi Lens reports authenticated YouTube playback progress to pi-lens-api.penpencil.co on play, seek, and page leave.
On YouTube pages, Pi Lens records the current video ID and playback position when you play, seek, or leave a video, then sends that activity to its authenticated Pi Lens API when a token is present. It also forwards YouTube page URLs, titles, persistent identifiers, and related event details to Google Analytics for extension events.
Who publishes itPhysicsWallah Limited - no other listings under this identity
PhysicsWallah Limited - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Pi Lens uploads the URL and title of every site you visit, not just YouTube
We observed the extension sending the URL, page title, and a timestamp for every http(s) page you open to Pi Lens's own servers, including sites the extension has no declared reason to access.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open or switch to any http or https tab.
This includes ordinary browsing like Wikipedia, news sites, or work tools, not just YouTube or Pi Lens's own site.
The extension records that page's URL and title and uploads it to Pi Lens's servers.
The only filter applied is whether the URL starts with http or https; there is no check against the sites the extension is actually meant to work on.
- Page URLhttps://en.wikipedia.org/wiki/Anna_Ottosson
The full address of every page you open, including query parameters.
- Page titleAnna Ottosson - Wikipedia
The title of the page, which often reveals what you were reading or searching for.
- Device ID00c29126-7e3a-4f2b-9c1d-8a5e6f3b2d10
A persistent identifier stored on your device that ties every batch back to the same install over time.
- Capture time2026-09-08T07:02:14.331Z
The exact moment the page was recorded, letting Pi Lens reconstruct a timeline of your browsing.
Every page you visit is staged here first, then flushed to Pi Lens's backend in the next upload cycle and cleared from the queue on success.
- Location
- chrome.storage.local key 'BROWSER_HISTORY_QUEUE'
{ "BROWSER_HISTORY_QUEUE": [ { "url": "https://www.bbc.co.uk/news/technology", "title": "Technology - BBC News", "capturedAt": "2026-09-08T07:01:48.902Z" }, { "url": "https://www.theguardian.com/international", "title": "News, sport and opinion from the Guardian's global edition", "capturedAt": "2026-09-08T07:02:03.115Z" } ]}200 OK, {"success":true}, accepted with no login and no relationship to YouTube or Pi Lens content required.
- Content-Type
- application/json
- xx-kong-userid
- 00c29126-7e3a-4f2b-9c1d-8a5e6f3b2d10
{ "deviceId": "00c29126-7e3a-4f2b-9c1d-8a5e6f3b2d10", "pseudoId": "00c29126-7e3a-4f2b-9c1d-8a5e6f3b2d10", "capturedAt": "2026-09-08T07:02:19.004Z", "pages": [ { "url": "https://en.wikipedia.org/wiki/Anna_Ottosson", "title": "Anna Ottosson - Wikipedia" }, { "url": "https://www.bbc.co.uk/news/technology", "title": "Technology - BBC News" }, { "url": "https://www.theguardian.com/international", "title": "News, sport and opinion from the Guardian's global edition" } ]}The per-page capture handler, wired to every tab event
Readable: capture handler
background/index.jsconst captureVisit = async (tab) => { try { if (!tab.url || !isHttpUrl(tab.url)) return; const now = Date.now(); if (lastCapture && lastCapture.url === tab.url && now - lastCapture.at < 30_000) return; const entry = { url: tab.url, title: tab.title, capturedAt: new Date().toISOString() }; const queue = [...await getQueue(), entry]; const trimmed = queue.length > 500 ? queue.slice(queue.length - 500) : queue; await saveQueue(trimmed); lastCapture = { url: tab.url, at: now }; if (await isEnabled()) await setFlushed(false); scheduleFlush(); } catch (e) {}};Readable: scheme filter and upload
background/index.jsconst isHttpUrl = (url) => { try { const parsed = new URL(url); return parsed.protocol === 'http:' || parsed.protocol === 'https:'; } catch { return false; }};const ingestBatch = async (batch, userId) => { const headerId = userId ?? batch.deviceId; const res = await httpClient.post(ENDPOINTS.ingestBrowserHistory, batch, { customHeaders: { 'xx-kong-userid': headerId }, isPublic: true, errorMessage: 'Failed to ingest Chrome browser history batch', }); if (!res?.success) throw new Error('Failed to ingest Chrome browser history batch'); return res.data;};- pi-lens-api.penpencil.co
Pi Lens's own backend (a Physics Wallah / PenPencil product). Receives the browsing batch, device ID, and account ID when logged in.
Where it sends data
Destinations our analysis observed Pi Lens - Notes, PYQs, Quizzes and more on Youtube contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google-analytics.comwidely used
Pi Lens - Notes, PYQs, Quizzes and more on Youtube sends data to www.google-analytics.com. A widely used service: 346 other extensions we have analysed send data here.
- pi-lens-api.penpencil.co
Pi Lens - Notes, PYQs, Quizzes and more on Youtube sends data to pi-lens-api.penpencil.co. No other extension we have analysed sends data here.