Is Work.ink Pass - bypass work.ink links safe?

High risk

Work.ink Pass redirects most visited pages through pass.work.ink with the page URL and extension fingerprint.

On most non-work.ink pages, the extension stops the page at document start and asks pass.work.ink where to redirect next. That request includes the encoded current URL, a persistent extension fingerprint, and whether a supported ad blocker is installed.

Work.inkv1.0.11Chrome Web Store
73Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Work.ink Pass sends every page you visit to pass.work.ink with a persistent ID

On your first visit to almost any site, the extension halts the page and sends its full URL, plus a persistent per-install ID, to pass.work.ink before letting you continue.

Severity
High unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You open an ordinary website, such as a search result or online store.

The extension did this

The extension stops the page from loading and sends its URL to pass.work.ink.

It then replaces the page with whatever destination the server sends back.

Captured request
GEThttps://pass.work.ink/redirect/aHR0cHM6Ly93d3cuZXhhbXBsZS5jb20v?fingerprint=959340ed-6964-412e-8ea7-8334e3ce7772-1788887747230&adblockerInstalled=0&base64=1&json=1

{"noRedirect":true,"to":"https://pass.work.ink/go/<destination>"}. The extension immediately navigated to that returned URL.

Why you can't catch this in DevTools

The page address is base64-encoded into the request path, so it is not immediately readable in a casual glance at network traffic.

Decoded value
https://www.example.com/
Sent to pass.work.ink on every qualifying page load
  • Page address
    https://www.example.com/

    The full address of the page you are currently on.

  • Persistent ID
    959340ed-6964-412e-8ea7-8334e3ce7772-1788887747230

    A device ID created once at install and reused on every request, letting the server link all your visits together.

  • Ad blocker detected
    none (0)

    Which ad-blocking extension, if any, is running in the same browser.

The code that does this

The exclusion list and redirect trigger in redirect.js

Readable version
const url = window.location.href;let last = await chrome.storage.session.get('redirected_' + host);if (last.redirected_host + TEN_HOURS_MS < Date.now()) {  await chrome.storage.session.remove('redirected_' + host);}last = await chrome.storage.session.get('redirected_' + host);// Skip work.ink itself, payment/checkout-like URLs, and hosts already sent this windowif (!url || !url.startsWith('http') || url.includes('work.ink') ||    last.redirected_host || url.includes('/redirect') || url.includes('/monetize') ||    url.includes('payment') || url.includes('checkout') || url.includes('gateway')) {  return;}window.stop();await chrome.storage.session.set({ ['redirected_' + host]: Date.now() });const fingerprint = (await chrome.storage.local.get(['fingerprint'])).fingerprint;const adblockerInstalled = (await chrome.storage.local.get(['adblockerInstalled'])).adblockerInstalled ? 1 : 0;const res = await fetch(  `https://pass.work.ink/redirect/${encodeURIComponent(btoa(url))}?fingerprint=${encodeURIComponent(fingerprint)}&adblockerInstalled=${adblockerInstalled}&base64=1&json=1`);const { to } = await res.json();window.location.replace(to);
Runs on every website, not just work.ink

The listing describes an ad-skipping tool for work.ink links. The content script matches every website and only skips work.ink itself and pages whose URL contains payment- or checkout-like text.

What it can do

Permissions this extension asks for, as declared in version 1.0.11. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See, disable and uninstall your other extensions, including your security ones

    management

Where it sends data

Destinations our analysis observed Work.ink Pass - bypass work.ink links contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • pass.work.ink

    Work.ink Pass - bypass work.ink links sends data to pass.work.ink. 2 other extensions we have analysed send data here.

Updated 21 September 2026ihmilkpcjhagmcdeamfkomlhkjgodlno