VaultWatch

Finds risky extensions, watches for cookie tampering and fake sign-in pages, and shows you how to really end a stolen session.

VaultWatch helps you catch the things that quietly lead to hijacked accounts: risky browser extensions, weak login cookies and fake sign-in pages. It runs on your device and it is free and open source. EXTENSION CHECK VaultWatch lists every extension you have installed and rates each one by what it is able to do, such as reading your cookies or accessing every website you visit. It re-checks every 30 minutes and alerts you when a new extension appears or when an update asks for more access than before. A high rating is not proof that an extension is bad. It shows you which ones deserve a second look, and you can mark the ones you trust. SESSION CHECK VaultWatch reviews your login cookies for weak settings, such as cookies that can travel over an unencrypted connection or be read by scripts on the page. When you choose "Sign out and clear" for a site, it also opens that site's security page (Google, Microsoft, GitHub and Dropbox are built in) so you can end your other sessions. Clearing cookies on your own computer does not sign out a copy that someone has already stolen, and this feature is built around that. An experimental alert also tells you when a login cookie appears without the website sending it, which can point to an extension writing cookies. PAGE SHIELD Shows a warning banner on sign-in pages that pretend to be another service, use look-alike characters in the address, send your password to a different website, or submit it without encryption. Everything is checked locally. Page content is never sent anywhere. SITE LOCKDOWN Optionally blocks scripts loaded from other websites on a single site you choose. This can stop card skimmers and keyloggers, but it can also break parts of a page, so you can turn it off for any site. YOUR PRIVACY - VaultWatch asks for no website access when you install it. Cookie access and site access are optional, and you are asked only when you turn on a feature that needs them. - Cookie values are never stored or sent anywhere. - No analytics, no tracking and no remote code. WHAT IT CANNOT DO VaultWatch cannot stop malware that is already running on your computer, so keep endpoint protection on. It cannot tell you which extension read a cookie, only that a cookie was written unexpectedly. Passkeys and sites that tie sessions to your device are the lasting fix. VaultWatch is an early warning, not a replacement for them. Works on Chrome, Edge and Brave.