Is SecHard safe?

SecHard's PAM vault decrypts stored account passwords in the browser using the account's own username as the decryption key.

When SecHard auto-fills or reveals a privileged account password, the extension fetches the account record from the server and decrypts the AES-encrypted password client-side, using that account's plaintext username as the decryption passphrase. Because the server returns the username in the same JSON response as the encrypted password, anyone who can read that HTTP response (for example via browser devtools) has everything needed to reproduce the decryption and recover the plaintext credential themselves.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.