Security: what OTP.pink protects, and what it cannot

This page is about the OTP.pink extension. The site you are reading is a separate thing: it counts visits, and the privacy page says how.

What it protects against

• A copy of your data without your passphrase. The vault in the browser’s extension storage, the automatic backups and the .pinkotp export are encrypted. Someone who copies your browser profile or one of these files learns nothing about your accounts beyond the vault’s approximate size and its key-derivation parameters. How long a guess takes depends on the passphrase you choose.
• Tampered or hostile files. The encrypted data, the metadata bound to it and each wrapped key are authenticated: a change to any of them makes the vault or the file fail to open rather than open wrong. An imported file is checked for size, structure and key-derivation parameters before any key is derived, so a file cannot make the extension run an unbounded computation.
• The network. The extension makes no network requests, so there is no server that could leak or be breached, and nothing to intercept.
• The pages you visit. OTP.pink has no permanent access to any site. It reads a tab only after you open it there, and only while the browser keeps that access for the tab. The script it runs there only reads the page and makes no requests, and what it finds is shown to you before anything is added.
• An old passphrase. Changing the passphrase replaces the data key and re-encrypts the vault, so old key material put back cannot open the current vault with the old passphrase.

What it does not protect against

• A compromised computer or browser. Malware, a compromised browser, or another extension able to debug or inspect extensions can read what OTP.pink shows and, while the vault is unlocked, its key.
• Rollback, deletion or damage. Someone able to write the browser’s extension storage can put back an older, correctly encrypted copy of the vault — bringing back an account you deleted — or delete or damage it. The automatic backups live in the same browser profile, within the same reach, and are removed with the extension. The way back is a .pinkotp file you keep outside the browser (backups). Automatic backups are described here for Chrome and Edge; in Firefox they have not been checked yet.
• A weak passphrase. Argon2id slows guessing down; it does not make a short or reused passphrase safe.
• Older files. A .pinkotp file or an automatic backup made before a passphrase change still opens with the passphrase in use when it was made. If that passphrase leaked, delete them.
• What you take out in the clear. Unencrypted exports, QR codes shown on screen and the printed recovery sheet hold your keys as they are. A code copied to the clipboard can be read by other software while it is there. Clearing the clipboard is a convenience, not a guarantee: OTP.pink cannot read the clipboard to check what is on it, so anything you copied after the code is cleared too. Clearing is checked in Chrome; in Edge and Firefox it has not been checked yet.
• Phishing. A code typed into a fake site can be used by that site at once. OTP.pink puts the codes for the site you are on first, but it does not judge the site for you.
• The settings beside the vault. A small device record is kept unencrypted: the theme, the automatic lock time, a clock correction, a random device id, when this browser last exported the vault (with a digest of the encrypted vault at that moment, for the export reminder) and until when that reminder is snoozed, and two switches of features that are not in this version.

The encryption, in numbers

• The vault is encrypted with AES-256-GCM under a random 256-bit data key, with a fresh 12-byte nonce on every write. The metadata stored beside the ciphertext is authenticated with it.
• The data key is wrapped with a key derived from your passphrase by Argon2id: 64 MiB of memory, 3 passes, parallelism 1.
• The passphrase has at least 8 characters and is never stored.
• An imported or restored file is checked before any key is derived from a passphrase: files over 10 MiB are refused, and unpacking is capped at 16 MiB.

The lock

The vault locks after the idle time you choose — 1, 5 or 15 minutes, 1 hour, or never — and when the browser closes. While it is unlocked, the data key is kept in the browser’s session storage, which lives in memory and is cleared when the browser closes, where the extension can close it to its other contexts; where it cannot, the key stays only in the memory of the extension’s background. Lock times and passphrase changes are on lock and passphrase.

What the extension may do

Permissions in Chrome and Edge: storage, alarms, activeTab, clipboardWrite, scripting, contextMenus, offscreen, and sidePanel. In Firefox: storage, alarms, activeTab, clipboardWrite, scripting, and contextMenus. Optional, asked only when you turn a setting on: tabs.

• On a page: only on a tab where you opened OTP.pink — its toolbar button, its context-menu item or your shortcut. There it runs a script packaged with the extension that reads the page for a QR code, a setup link or a written-out key, changes nothing and sends nothing. While the browser keeps that access for the tab, it looks again when a page loads there. To read a QR the script cannot reach, it takes a picture of the visible tab.
• The clipboard: it writes the code you copy, and later writes an empty string to clear it (checked in Chrome, not yet in Edge and Firefox). It never reads the clipboard.
• Codes for the site on any tab — an optional setting. Turned on, it asks the browser for the tabs permission (the browser words it “Read your browsing history” or “Access browser tabs”) and reads only the address of the active tab, never its contents. A site is kept only when you tie it to an account.
• No host permissions, no webRequest, no content scripts that stay on pages, and a content security policy that starts with default-src 'none' and sets connect-src 'none'.

Check it yourself

The promise: the extension’s code makes no http:, https:, ws: or wss: request and no WebRTC connection — not to a server, not to the page you are on. Loading its own packaged files (chrome-extension://…, moz-extension://…) and local data: or blob: addresses are not network requests.

1. The side panel. Chrome or Edge: right-click inside the panel → Inspect → Network. Firefox: about:debugging → This Firefox → OTP.pink → Inspect → Network; that toolbox belongs to the extension’s background, and the sidebar may need its own (right-click inside it → Inspect, with the browser toolbox enabled).
2. The background. Chrome or Edge: chrome://extensions (or edge://extensions) → Developer mode → OTP.pink → service worker → Network. In Firefox the same Inspect window covers it.
3. Use the extension: unlock, add an account, find a key on a page, copy a code, export. The Network tab lists only the extension’s own files.

In Firefox these steps have not been walked yet: which window shows the sidebar’s requests, and finding a key from the sidebar, are still to be checked.

The links in the panel’s footer — 301.st, the store — are ordinary links that open a new tab when you click them; the extension loads nothing from them.

Staying safe with it

• A long passphrase you use nowhere else.
• A lock time that fits how you leave your computer.
• An encrypted .pinkotp export kept outside the browser, and its passphrase remembered. The panel reminds you again 30 days after an export if the vault has changed since.
• Delete unencrypted exports once they are imported, and keep a printed sheet as you keep a passport.