Manifest V3 Free 64 KiB
BrowserProfileLock puts a master password in front of your Chrome profile. One shortcut hides every open tab behind a lock screen, and your tabs come back exactly as they were when you unlock.
Locked out already? Open the reset portal You will need your registered email address.
Profile locked
Enter your master password to continue.
Caps Lock is on
Forgot Password? (offline reset)
Demo only A visual preview. Nothing here is encrypted or stored.
The gap
Chrome has no built-in lock for a profile. Close the lid and the session is still live; open it and your mail, your bank tab and your saved passwords are one click away. A screen lock helps, until you have already unlocked the machine and handed it over.
A hot desk, an open-plan office, a lab machine. You walk to the kitchen and your tabs stay on screen.
One machine, several people, one Chrome profile that quietly stays logged into everything you use.
Thirty seconds at the counter. The laptop is open, unattended, and pointed at the room.
Someone needs to look something up. You want to lend the browser without lending your accounts.
Features
Everything below ships in version 1.1.0. Nothing here is planned, beta, or coming soon.
Lock from the toolbar popup and every open tab is replaced by the lock screen. Nothing in the profile is browsable until the password goes back in.
Your password is hashed with PBKDF2-HMAC-SHA256 at 100,000 iterations against a random per-profile salt. The password itself is never written anywhere.
Pick 1, 5, 15 or 30 minutes of system idle, or switch it off. The countdown watches the machine, not the tab.
Counting down to auto-lock.
Ctrl Shift L locks immediately. Remap it on Chrome's own shortcuts page if it clashes.
A toggle that locks the profile every time the browser starts, so a reboot does not reopen a live session.
The badge turns red and reads LOCK while the session is locked, so state is never a guess.
Open tabs are remembered before the lock screen takes over and reopened once you unlock. Locking is not a reason to lose your place.
One toggle applies a dark treatment to any site, and it persists across page loads and new tabs. Drag the divider to compare.
Dark modeOriginal
Push it to managed machines with Chrome's ExtensionInstallForcelist policy, so users cannot remove it.
Confirm-password fields on setup and on change, a show/hide toggle on every field, a Caps Lock warning on the lock screen, and the current password required before you can change it.
How it works
The extension is inert until you create a profile. Locking, the shortcut, idle auto-lock and dark mode all stay disabled until setup is finished, so a half-configured install can never lock you out.
Add it from the Chrome Web Store. The options page opens by itself on first install, so there is nothing to go hunting for.
Give a name, a working email address and a master password, twice. The email is validated strictly and disposable domains are refused, because account recovery depends on that address being reachable.
Click the toolbar button, press the shortcut, or let the idle timer do it. Every tab is replaced by the lock screen and restored when you unlock.
Account recovery
Most lock extensions have one answer if you forget: wipe it and start over. BrowserProfileLock has an offline reset protocol instead. Each install generates its own ECDSA P-256 device keypair at setup, and recovery is a four-step challenge and response you read off the screen and type in by hand.
The locked machine does not need a network connection. You can do the portal half on your phone or another computer. You will need the email address the device was registered with.
Step 2 and 4 happen here
The portal is the other half of the reset. It takes the device code off your lock screen and hands back a challenge, then turns your signed response into the authorization token that clears the password.
Portal address browserlock-reset.iamtac.com
Open Reset PortalOpens in a new tab. Any device will do — a phone is fine, and the locked computer does not need to be online.
Have these ready
Choose Forgot Password? on the lock screen. The extension shows a code that identifies this install and this attempt.
On the extensionEU3D-A2JV-AJMX-WFN4
Sign in to the recovery portal with your registered email and type the device code in. It returns a short challenge code.
On the portalH4KP-2M9T
Type the challenge into the extension. It signs the challenge with the device private key, which never leaves the machine, and shows a response code.
On the extensionR8B3N-9X1KQ
Give the response code back to the portal and it issues an authorization token. Enter that in the extension and you can set a new master password.
On the portal7QMD-K3XV-P8LT
Security and privacy
Device enrollment, once, at setup. It sends your name, your email address and a public key so recovery can work later. That is the whole list. No browsing data is part of it.
Screenshots
Select any image to open it larger. Use the arrow keys to move between them and Escape to close.
The toolbar popup. Status at the top, one button to lock, and the dark mode switch.
The lock screen that replaces every tab. The Forgot Password link starts the offline reset.
First-run setup. The confirm field is there so a typo cannot lock you out on day one.
The Profile panel in settings: lock on restart, the idle timeout, and the current shortcut.
The offline reset wizard, part-way through the challenge and response exchange.
Browser-wide dark mode on a site that does not offer one of its own.
Get it
Free — Works on Chrome, Edge, Brave and other Chromium browsers
64 KiB. Small enough that it costs nothing measurable in memory or startup time. There is no framework in here, no bundled font, and no analytics client.
Scan to open on your phone
Chrome extensions install on desktop, so this is for sending the link to yourself or passing it to someone else.
Or type it in: https://chromewebstore.google.com/search/BrowserProfileLock?hl=en-US&utm_source=ext_sidebar
FAQ
You use the offline reset. The lock screen gives you a device code, the recovery portal turns it into a challenge, the extension signs the challenge with its device key, and the portal returns an authorization token that lets you set a new password. It works with no network connection on the locked machine, because you can do the portal half from a phone or another computer.
You do need the email address you registered at setup. If that address is gone, so is the recovery path, which is why disposable domains are rejected during signup.
No, and it would be dishonest to say otherwise. An extension runs inside the browser. Somebody sitting at your unlocked machine who knows their way around can open developer tools, disable extensions from the extensions page, or read the profile directory directly.
What it does stop is the realistic case: a person who walks past, sits down, or is handed your laptop. For protection a user cannot turn off, deploy it through Chrome's ExtensionInstallForcelist policy on managed devices and combine it with disk encryption and your OS lock screen.
The whole extension is 64.03 KiB and does nothing while unlocked except watch for the idle signal and the lock shortcut. The password derivation, which is the only expensive operation, runs when you set or check a password, not while you browse.
Only if you allow it. Chrome disables extensions in Incognito by default; you can turn it on per extension from chrome://extensions under "Allow in Incognito". Bear in mind Incognito windows are separate by design, so treat it as a setting to check rather than assume.
One request, once, at setup: device enrollment, which sends your name, your email address and a public key so that recovery can work later. Nothing else. No browsing history, no page content, no analytics, no ads, no third-party trackers.
Your master password never leaves the machine in any form, and neither does the device private key.
Yes. The default is Ctrl Shift L, or Command instead of Ctrl on macOS. Chrome owns the shortcut list, so you remap it at chrome://extensions/shortcuts like any other extension.
No. The open tabs are recorded before the lock screen takes over, and reopened after a successful unlock. That is deliberate: a lock you are reluctant to use because it costs you your tabs is a lock you will not use.
Yes, through Chrome's ExtensionInstallForcelist policy. Force-installed extensions cannot be removed by the user, which is the difference between a personal convenience and an enforced control. Your existing Chrome policy tooling, whether that is group policy, Jamf, or the Google Admin console, is all you need.
It is built as a Manifest V3 extension, so it runs on Chromium-based browsers including Edge, Brave, Opera and Vivaldi. Install it from the Chrome Web Store; Edge and Brave both allow that. Some browsers name the shortcuts page differently, and idle detection depends on the browser reporting system idle state, so check those two after installing.
