Is Devolutions Password Manager safe?
Devolutions Workspace reads form fields on every page to autofill saved logins, and ships hardcoded credentials for its telemetry server.
As a password manager, Devolutions Workspace injects a content script into every http/https/file page and frame that enumerates forms and reads input field values (including hidden fields, truncated at 254 chars) to power autofill. A second script runs in the page's main world and intercepts navigator.credentials.create/get calls to relay WebAuthn challenges to the extension. The background script also embeds a fixed username and password used to POST analytics to Devolutions' OpenSearch telemetry server; because extension source is readable after install, those credentials are effectively public.
Who publishes itDevolutions - 2 other listings from the same operator, none carrying a finding
Devolutions - 2 other listings from the same operator, none carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same operator - 2 listings
Published under a different store account, but sharing the registered address, contact or declared legal entity this one gave the store.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
OpenSearch Basic-auth credentials in the extension package
Devolutions Password Manager includes an OpenSearch Basic-auth username and password in its background script, used to build a daily analytics POST to telemetry2.devolutions.net:9200, so anyone inspecting the package can read both values.
What actually happens
You keep the extension installed while its background script is running.
The analytics sender runs on startup and then uses a 24-hour interval before sending again.
The extension builds an OpenSearch analytics request with Basic-auth credentials stored in its own code.
The packaged source includes the account name and password value used for the request.
When this fires
Every 1 day
The analytics sender runs once when the background script initializes, then suppresses another send until a full day has elapsed.
Captured request
The request construction was confirmed in source; no dynamic response body was recorded for this claim.
- Content-Type
- application/json
- Authorization
- Basic <redacted>
Fields and constants used by the OpenSearch analytics request
- Analytics hosttelemetry2.devolutions.net:9200
This is the remote service that receives the analytics request from the extension.
- Basic-auth accountWBEX_2025.3
This account name is packaged with the extension and is used to authenticate the OpenSearch write request.
- Basic-auth passwordpassword value redacted
The corresponding password is also packaged with the extension, making the credential readable from the installed code.
- OpenSearch indexwbex_configuration_events
This names the destination collection where the extension writes the settings event.
- Installation identifier4f45d8a3-2c6d-4d3b-9f25-1f0c7f7a8b61
This value lets the analytics event be tied back to the same extension installation over time.
- Application and browser detailsWBEX 2026.2.0.6 on Chrome/Linux, en-US
These fields describe the extension version, browser, operating system, architecture, and language included in the analytics event.
- Never-list countersneverAutofillCount: 2
These counters summarize how many sites were added to local lists that prevent saving, autofill, or icons.
The code that does this
The shipped constants and request builder
Readable OpenSearch constants
deobfuscated/background/background.jsconst FA = { url: "https://telemetry2.devolutions.net:9200", username: "WBEX_2025.3", password: "<redacted>", datasourceFeatureEventIndex: "wbex_configuration_events", featureEventIndex: "feature_events"};Readable daily sender
deobfuscated/background/background.jsstatic async send() { try { const e = await x.getLocalStorageModelKey(["settings", "analyticsInfos", "NeverAddSite", "NeverAutofill", "NeverDoAnything", "NeverShowIconsInFields"]); if (!e.settings || e.settings.disableAnalytics) return; const i = e.analyticsInfos?.lastSentAt ?? 0; if (Date.now() - i < this.TWENTY_FOUR_HOURS_MS) return; const n = { neverAddSiteCount: (e.NeverAddSite ?? []).length, neverAutofillCount: (e.NeverAutofill ?? []).length, neverDoAnythingCount: (e.NeverDoAnything ?? []).length, neverShowIconsInFieldsCount: (e.NeverShowIconsInFields ?? []).length }, r = !!(await M.getManagedStorageItem())?.Settings, a = await this.getInstallID(); await x.setLocalStorageModel({ analyticsInfos: { ...e.analyticsInfos, applicationInstallUniqueId: a, lastSentAt: Date.now() } }), await this.sendToOpenSearch(e.settings, n, r, a); } catch (e) { le.debug(e); }}Readable OpenSearch POST builder
deobfuscated/background/background.jsstatic async sendToOpenSearch(e, i, n, s) { const { url: r, username: a, password: l, datasourceFeatureEventIndex: u } = FA, d = u, h = await this.getApplicationInfos(), c = { eventDate: new Date().toISOString(), eventId: As(), installId: s, application: h, settings: this.sanitizeSettings(e), neverList: i, hasManagedSettings: n }; await fetch(`${r}/${d}/_doc`, { method: "POST", headers: { "Content-Type": "application/json", Authorization: `Basic ${btoa(`${a}:${l}`)}` }, body: JSON.stringify(c) });}Remote host used by this claim
- telemetry2.devolutions.net
Devolutions telemetry host that receives OpenSearch analytics POST requests on port 9200.
What it can do
Permissions this extension asks for, as declared in version 2026.3.3.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
*://*/*
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Add items to the right-click menu
contextMenus
Talk to a program installed on your computer, outside the browser's sandbox
nativeMessaging
Store an unlimited amount of data in your browser
unlimitedStorage
Read and change cookies, including the ones that keep you signed in
cookies
Run its own code inside the pages you visit
scripting
Run hidden pages in the background
offscreen
Act on the current tab, but only after you click the extension
activeTab
Write to your clipboard
clipboardWrite
Detect when you step away from your computer
idle
Watch every request your browser makes
webRequest
Where it sends data
Destinations our analysis observed Workspace contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- telemetry2.devolutions.net
Workspace sends data to telemetry2.devolutions.net. No other extension we have analyzed sends data here.