Nimblepass Privacy Policy
Effective 19 October 2026. Applies to Nimblepass 1.0.0 and later.
Nimblepass is a password manager extension for Google Chrome that works with a Vaultwarden server you run or choose yourself. Nimblepass is an independent open-source project. It is not affiliated with or endorsed by Bitwarden, Inc. or with the Vaultwarden project.
The short version
- We collect nothing. The developer of Nimblepass runs no servers, receives no data, and has no way to see your vault, your browsing or your usage. There is no telemetry, analytics, crash reporting or advertising.
- Your vault goes only to the server you set. Before it leaves your device, it is encrypted with keys derived from your master password. The server stores it encrypted and cannot read it.
- A few optional features contact third-party services. Each one is listed below with exactly what it sends. None of them receives your passwords or vault contents.
- No data is sold, shared for advertising, or used for anything except the features you use.
Data stored on your device
These are kept in Chrome's local extension storage and IndexedDB on your computer:
| Data | Form | Purpose |
|---|---|---|
| Your vault (logins, cards, identities, notes, SSH keys, passkeys, attachments metadata, folders) | Encrypted with your vault key, exactly as the server stores it | Offline access and fast search |
| Unsynced edits (the outbox) | Encrypted | Kept until the server is reachable, so edits made offline are not lost |
| Server URL, email address, encrypted keys, access/refresh tokens (sealed) | Encrypted or sealed where they are secrets | Staying logged in, unlocking |
| Settings (lock timeout, autofill preferences, blocked domains, theme, language) | Plain | Your preferences |
| Website icons downloaded from your icon service | Images | Showing icons beside vault items |
| Generator history | Encrypted | Recalling recently generated passwords |
While the vault is unlocked, its decrypted contents are held only in memory in the extension's service worker. To stay unlocked when Chrome restarts that worker, the vault key is kept sealed in Chrome's session storage, which is held in memory and cleared when the browser closes. Locking the vault discards both. Nimblepass does not use chrome.storage.sync, so nothing is copied to your Google account.
Uninstalling the extension deletes all of the data above from your device. Your vault on your server is unaffected.
Network connections
Nimblepass makes network requests only to the destinations below. The list was confirmed by reading the source code (every fetch, WebSocket and navigation in the shipped extension).
1. Your Vaultwarden server (required)
This is the server URL you enter at login. Optionally, it can be split into separate web vault, API, identity, icons and notifications URLs under "Self-hosted environment".
| What | When | What is sent |
|---|---|---|
Login (/identity/accounts/prelogin, /identity/connect/token) | When you log in, or a session is refreshed | Your email address, a hash of your master password (never the password itself), any two-step login code, a random device identifier, and the device name "chrome" |
Vault API (/api/...) | Sync, and when you create, edit, delete, share or move items, Sends, folders, or account settings | Your access token and encrypted item data |
Notifications hub (/notifications/hub, WebSocket) | While you are logged in | Your access token, so the server can push "vault changed" events |
Organization event log (/events/collect) | When you view, fill, or copy a secret of an item that belongs to an organization whose server keeps an event log (Vaultwarden's ORG_EVENTS_ENABLED) | The item's and organization's identifiers, the kind of event (viewed, filled, password shown or copied), and when it happened. Never the item's contents, and nothing for items in your own vault |
| Attachments | When you upload or open an attachment | The encrypted file. The download URL comes from your server; a server can be configured to store attachments on its own storage provider |
Website icons (<icons URL>/<hostname>/icon.png) | When "Show website icons" is on (on by default) | The hostname of each website saved in your vault, for example github.com. IP addresses, localhost and intranet names are never sent. Turn this off in Settings → Appearance |
Encryption in transit. Nimblepass connects to your server over HTTPS. There are two exceptions. A server on this computer (localhost, 127.0.0.1) may use plain http, because that traffic never leaves the device. A server on your own local network (a private IP address such as 192.168.x.x, or a .local/.lan name) may use plain http only after you explicitly tick "Allow insecure http connection (local network only)", which comes with a warning that your login and vault cross your network unencrypted. The vault itself stays end-to-end encrypted either way, but the login hash and access tokens are not protected by TLS on such a connection. Public addresses are always refused over plain http.
Passkey sign-in to your server. If you log in to or unlock your account with a passkey, Nimblepass opens a small window on your server's own address and runs its built-in WebAuthn code there, because the passkey belongs to your server's web vault. The window talks only to your server and closes when the ceremony ends.
Every request to your server also carries the headers Bitwarden-Client-Name: browser, Bitwarden-Client-Version and Device-Type, which Vaultwarden uses to enable features.
The operator of your server (you, or whoever runs it) can see what any server operator can see: your email address, IP address, request times, and the encrypted vault. They cannot decrypt the vault without your master password.
2. Duo (only if your account uses Duo two-step login)
When you choose Duo, Nimblepass opens the Duo URL your server provides in a browser tab. You sign in to Duo directly, and Duo returns you to your server's duo-redirect-connector.html. Nimblepass sends nothing to Duo itself.
3. Have I Been Pwned: Pwned Passwords (optional)
- Endpoint:
https://api.pwnedpasswords.com/range/<5 characters> - When: only when you click "Check" on an item, or turn on "Check for exposed passwords" in Vault health (off by default).
- What is sent: the first 5 hexadecimal characters of the password's SHA-1 hash. Your password and its full hash never leave your device. Matching against the returned list happens locally (the k-anonymity range API). Requests carry
Add-Padding: trueand no cookies. Have I Been Pwned sees your IP address. Its privacy policy: https://haveibeenpwned.com/Privacy.
4. 2fa.directory (Vault health)
- Endpoint:
https://api.2fa.directory/v3/totp.json - When: when you open the Vault health screen. The list is then cached on your device.
- What is sent: nothing about you. It is a plain download of the public list of websites that support two-step login, and matching against your vault happens locally. The 2fa.directory host sees your IP address.
5. Email forwarding services (optional, only those you configure)
If you set up a forwarding service in the username generator and generate a forwarded address, Nimblepass calls that service's API with the API key you entered. It sends nothing more than the service needs to create one alias:
| Service | Endpoint | Sent besides your API key |
|---|---|---|
| SimpleLogin | app.simplelogin.io/api/alias/random/new (or your self-hosted URL) | The website's hostname, and a note "Website: <host>. Generated by Nimblepass." |
| addy.io | app.addy.io/api/v1/aliases (or your self-hosted URL) | Your alias domain, and a description with the website's hostname |
| Firefox Relay | relay.firefox.com/api/v1/relayaddresses/ | The website, and a description |
| Fastmail | api.fastmail.com/jmap/session and /jmap/api/ | The website's domain (forDomain) |
| DuckDuckGo Email Protection | quack.duckduckgo.com/api/email/addresses | Nothing |
| Forward Email | api.forwardemail.net/v1/domains/<your domain>/aliases | The website as a label, and a description |
Your use of these services is governed by their own privacy policies.
6. Websites you visit (passkeys only)
When a website asks to use a passkey whose relying-party ID is not part of its own address (WebAuthn "related origins"), Nimblepass fetches https://<relying party>/.well-known/webauthn to check that the site is allowed to use it. This is the same check Chrome itself performs. The request carries no cookies or referrer.
Links you click
Clicking a link opens a normal browser tab; Nimblepass itself sends nothing. Examples are the project's GitHub page in About, a site's /.well-known/change-password page, or a forwarding service's settings page.
Nothing else
There are no other network connections. In particular, Nimblepass makes no requests to its developer, Google (beyond Chrome's own extension updates), analytics or advertising services, or CDNs. All code, fonts and WebAssembly ship inside the extension package. No remote code is ever loaded.
What Nimblepass reads on web pages
To autofill, Nimblepass's content scripts look at the forms on the pages you visit, such as which fields are usernames, passwords or card numbers. This happens locally. Page content is never sent anywhere. When you sign in on a site, the username and password you typed go to the extension itself, so it can offer to save them. They are stored (encrypted) only if you click Save.
Other features that read data:
- Scan QR code (adding an authenticator key) takes one screenshot of the visible tab when you click it. It decodes the image on your device and discards it.
- Clear clipboard after copy reads the clipboard once, to check that it still holds what Nimblepass copied before clearing it. The contents are not stored or sent.
- HTTP sign-in dialogs. When a site asks for HTTP Basic or Digest authentication, Nimblepass answers with your saved login for that site, and only when exactly one login matches.
Permissions
What each Chrome permission is used for is listed in permissions.md.
Children
Nimblepass is not directed at children and collects no personal information from anyone.
Changes to this policy
Changes are published with the extension's source code and noted in the changelog. The effective date above will change. If a future version adds a network destination, this policy will list it before that version is released.
Contact
Questions or concerns: open an issue at https://github.com/macalinao/nimblepass/issues. For security reports, see SECURITY.md.