Is X Token Login safe?
X Token Login writes a pasted x.com auth_token value directly into the browser's cookies to log in as that account.
The extension's popup takes a raw auth_token string typed or pasted by the user and injects it into document.cookie on x.com via a content script, then redirects to x.com — signing the browser in as whatever account the token belongs to without a password or 2FA. Its own popup links to a third-party site advertised for buying X accounts, indicating it is intended for use with tokens obtained from outside the user's own login.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
Who publishes it1 other listing from the same operator, 1 of them carrying a finding
1 other listing from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
1 other listing published from this account, 197 users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
What it can do
Permissions this extension asks for, as declared in version 1.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on x.com
https://x.com/*
Run its own code inside the pages you visit
scripting