Is Privci.io: Smart Personal Data Manager safe?

Low risk

Privci.io captures typed passwords, hashes them with a weak reversible hash, and sends the hash to its backend to flag reuse.

Content scripts watch login fields on every site you visit and relay typed passwords to the background script, which hashes each one with a trivial 32-bit non-cryptographic hash (despite being named after the cyrb53 algorithm) and includes matching hash pairs in a monthly report sent to Privci's servers. The same content scripts also collect email and username values from login and OAuth sign-in buttons on any site and send up to 30 of them to Privci's backend to run recurring breach-database searches. All of this traffic is authenticated with a single hardcoded secret shared by every install of the extension.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

Privci.iov1.6.6Chrome Web Store
21Risk
Who publishes it

Privci.io - no other listings under this identity, 5 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Privci.io
Website
secure.privci.com/support

Shared hosts - 5 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.privci.com
Also called by 1 other listing: CybaWay
adara.com
Also called by 4 other listings, including Avast Online Security & Privacy, AVG Online Security
datacloudoptout.oracle.com
Also called by 4 other listings, including Avast Online Security & Privacy, AVG Online Security
optout.liveramp.com
Also called by 4 other listings, including Avast Online Security & Privacy, AVG Online Security
youronlinechoices.com
Also called by 5 other listings, including Poulpeo : cashback, réductions et codes promo, Poulpeo : cashback, réductions et codes promo

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.6.6. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/* and 2 more

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Show you desktop notifications

    notifications

  • Run its own code inside the pages you visit

    scripting

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Read and change your full browsing history

    history

  • Watch every request your browser makes

    webRequest

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Where it sends data

Destinations our analysis observed Privci.io: Smart Personal Data Manager contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.privci.com

    Privci.io: Smart Personal Data Manager sends data to api.privci.com. No other extension we have analyzed sends data here.

Updated 2 November 2026ainaapbfiabjebmgjhaajfmfnbmmnjnl