Is it safe to save passport detailsYour click in a browser extension?

You've typed your passport number into four portals this month, and a form-filling extension promises you'll never have to again. Then a small voice asks: where does that number actually go once I save it?

That's the right question. This guide gives you a straight answer, the research behind it, and a five-point checklist you can apply to any extension, including ours.

Is it safe to save passport details in a browser extension?

It can be, but safety depends on the extension, not on extensions in general. Check five things: who publishes it, which permissions it asks for, where and how your details are stored, whether it asks before filling sensitive fields, and what it sends to servers or AI. If an extension can't answer all five plainly, don't trust it with your passport.

Your passport number on its own won't empty a bank account. Combined with your name, date of birth and address, though, it's a strong identity kit. Treat it like you'd treat a bank login.

The five questions, in short:

What does research say about malicious browser extensions?

Researchers have shown that extensions with access to a page can read sensitive form fields, including passwords, and that store review does not reliably catch this. A 2024 study found about one in eight Chrome Web Store extensions studied had permissions that would allow it, and a 2025 study reported malicious extensions could still be published.

The University of Wisconsin–Madison team behind the work found that "a significant percentage (12.5%) of extensions possess the necessary permissions" to read sensitive input fields, and identified 190 extensions that directly access password fields (arXiv 2308.16321 (opens in a new tab); presented at WWW '24 (opens in a new tab)). They also built a proof-of-concept extension designed to get through store review.

A separate 2025 study tested both major stores and concluded that "malicious extensions can still be developed, published, and executed" in the Chrome Web Store and Mozilla's add-ons store (arXiv 2503.04292 (opens in a new tab)).

What this means for you:

• Store listing is not a safety certificate. It's a starting point.
• Page access is the real risk. An extension that can read the page can read what you type on it, whether or not it "saves" anything.
• Fewer extensions, less exposure. Every installed extension with broad site access widens what could go wrong.

Which extension permissions should I accept, and which should I question?

A form filler genuinely needs to read and change the pages where it fills forms, so expect a site-access permission. Question anything beyond that, such as browsing history, downloads, or the ability to manage other extensions. Prefer extensions that explain each permission and let you limit which sites they can run on.

Chrome shows a warning before you install that lists what the extension can do. Chrome's developer documentation encourages extension makers to ask for some permissions only when needed, at runtime, rather than all at install (Chrome for Developers (opens in a new tab)).

How to read the permission list:

• "Read and change your data on websites" is expected for a form filler. Ask whether you can restrict it to specific sites.
• Browsing history is rarely needed to fill a form. Ask why.
• Downloads or file system access may be used for uploads, but should be explained.
• "Manage your apps, extensions and themes" is a red flag for a form filler.

Where is my passport data stored, and how is it encrypted?

Your saved details live either in the browser on your device, on the extension company's servers, or both. Either can be safe. What matters is that the data is encrypted at rest, that the most sensitive fields get extra protection, and that the company says so in specific terms rather than "bank-grade security".

Questions to ask the publisher, or look for on their security page:

• Is everything encrypted at rest?
• Do passport numbers, dates of birth, tax and bank details get separate protection, such as their own key?
• Is data encrypted in transit between the extension and the server?
• Can I delete my saved details, and does deletion actually remove them?
• Are business workspaces kept separate from each other?
• Does the company claim certifications? If so, can it show them? If not, does it say so plainly?

At AppliFlo, everything is encrypted at rest by Google Cloud (AES-256) and in transit (TLS). The passport, date of birth, tax and bank details you save for Fill as me are also encrypted with a separate application key. We don't hold security certifications such as SOC 2 or ISO 27001, and we don't claim to. Our security page sets out what we do in plain terms.

Why does confirm-before-fill matter for sensitive fields?

Confirm-before-fill means the extension asks you before entering a sensitive value, such as a tax file number or bank account, on a site where you haven't approved it. It protects you from filling the right number on the wrong site, including look-alike pages, and it keeps you aware of exactly where your most sensitive details are going.

Without it, a form filler will happily put your tax file number into any field labelled "TFN", on any site. With it, the first time a site asks, you see a prompt: fill your tax file number on this site? You choose yes or not now, and the choice is remembered for that site only.

AppliFlo for Chrome works this way. Tax file numbers and bank details fill only after you say yes, site by site, and you can change your mind later.

How does AppliFlo handle passport details, and what doesn't it claim?

AppliFlo encrypts everything at rest and in transit, and your saved Fill as me passport, date of birth, tax and bank details also get a separate application key. It asks before filling tax and bank details on each site. Its AI sees field labels, never your values. And it never submits a form or pays for you. It does not claim security certifications it does not hold.

Here is what that looks like on a real page. Suppose the portal shows a field labelled "Passport no." with an unusual layout. AppliFlo may send that label to AI to work out what the field is asking for. The value, your passport number, is never sent. It is filled from your encrypted record straight into the page.

What we don't claim:

• No SOC 2, ISO or other certifications.
• No promise that any extension, ours included, is risk-free.
• AppliFlo for Chrome is coming soon to the Chrome Web Store; it isn't listed there yet.

If you fill applications for yourself, Fill as me is free on every plan: save your details once, fill any online form, and press Submit yourself.

Your checklist before saving passport details

Before you save your passport number in any extension, confirm the publisher, permissions, storage, sensitive-field confirmation and AI handling. Then keep your extension list short and review it every few months. Ten minutes of checking now protects details that are slow and stressful to replace.

• I can name the company behind the extension and find its privacy and security pages.
• I've read the permission warning and every permission makes sense for filling forms.
• Site access is limited to the sites I need, where possible.
• Saved details are encrypted at rest, with extra protection for passport, tax and bank numbers.
• Sensitive fields need my confirmation on each new site.
• I know what is sent to AI, if anything, and my values are not.
• The extension never submits or pays for me.
• I've removed extensions I no longer use.

For the full picture of filling long portals safely, read how to autofill online application forms. For why the last click should stay yours, see why our form filler stops before Submit.