Is Torii Image Translator — AI Manga Translator, Manhwa Translator ... safe?

High risk

Torii is high risk. When you create or sign in to an account, the extension stores fingerprinting data, including an IP address, in Firestore. DB rows show the visitor ID used as a document key, stored with user metadata for multi-account detection.…

stringieeev2.22.4Chrome Web Store
75Risk
Who publishes it

stringieee - no other listings under this identity, 3 shared hostnames

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
stringieee
Website
toriitranslate.com/feedback

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.toriitranslate.com
Also called by 1 other listing: Torii Image Translator - AI Manga Translator
direct-api.toriitranslate.com
Also called by 1 other listing: Torii Image Translator - AI Manga Translator
toriitranslate.com
Also called by 1 other listing: Torii Image Translator - AI Manga Translator

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Device fingerprint and IP address sent to Firestore on account creation

When you create or sign in to an account, the extension stores fingerprinting data, including an IP address, in Firestore.

DB rows show the visitor ID used as a document key, stored with user metadata for multi-account detection.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You start an account login or creation action.

The extension did this

The extension stores device fingerprint data, including IP address, to Firestore.

Captured request
POSTfirestore.googleapis.com
Fields in the request
  • IP address
    203.0.113.42 (illustrative)

    Connects the account action to the network location used during fingerprinting.

  • Browsing history
    https://example.com/page (illustrative)

    Provides browsing context associated with the extension activity.

Error reports send your IP, email, User-Agent, and page URL to Torii

When Torii hits an internal error, including one that fires automatically in the background, it sends a report to its own server containing your IP address, signed-in email, User-Agent, and the page you were on.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You use Torii Image Translator and it hits an internal error.

This includes errors that happen automatically in the background, not just ones you cause directly, such as a dropped connection during onboarding.

The extension did this

Torii looks up your public IP address, then sends a report to its own server with that IP, your signed-in email, your User-Agent, and the page URL where the error happened.

The request is authenticated with a static bearer token that is hardcoded in the extension's own code.

Fields included in each error report
  • Your public IP address
    203.0.113.42 (illustrative; the lookup failed in our sandboxed test run, but the request schema and preceding IP lookup were confirmed)

    Looked up fresh from a third-party IP service immediately before the report is sent, then included in the report body.

  • Your account email
    jane.doe@gmail.com (illustrative; no account was signed in during our test)

    Included whenever you're signed into Torii, tying the report directly to your account.

  • Page URL
    toriiClick from: https://example.com/manga/chapter-42

    The address of the page you were on when the error fired is embedded in the report's location text.

  • Browser fingerprint
    agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/128.0.0.0, platform: Windows, brands: [Chromium 128]

    Your User-Agent string plus Chrome's browser-brand and platform data, identifying your specific browser and device.

Captured request
POSThttps://api.toriitranslate.com/api/reporting

Fired unprompted during the extension's own onboarding flow, not just in response to a planted test error.

Headers
Content-Type
application/json
Authorization
<redacted>
Body
{  "stack_trace": "TypeError: Failed to fetch",  "message": "Could not establish connection. Receiving end does not exist.",  "created": "2026-09-08T16:39:41.201Z",  "email": null,  "location": "onboarding",  "meta": {    "agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/128.0.0.0",    "platform": "Windows",    "brands": [      {        "brand": "Chromium",        "version": "128"      }    ]  },  "ip": null}
Where this data goes
    • api.toriitranslate.com

    Torii's own backend. Receives the full error report: your IP address, account email, User-Agent, and the page URL.

    • api64.ipify.org

    Independent IP-lookup service queried immediately before each error report, solely to populate the report's ip field.

API keys sent to vendor server before encrypted storage

Entering a third-party AI API key sends it to api.toriitranslate.com for server-side encryption before storage.

The same key is then reused in later upload and inpaint requests, exposing it to the vendor's service.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

The user enters a third-party provider API key in the extension.

The extension did this

The extension sends the raw key value to the vendor server for server-side encryption before storage.

Captured request
POSThttps://api.toriitranslate.com/api/byok/encrypt
Fields in the request
  • Your provider API key
    sk-proj-abc123... (illustrative)

    This credential can authorize usage of the third-party AI account or service it belongs to.

Updated 30 September 2026gkdekajjngdkocgiealohleibhdjhoed