Ukraine solidarity. Service offered free to Ukrainian businesses for as long as the war lasts. Request free access
Browser extensions · Alpha

The ARDNTECH vault in
your browser.

The ARDNTECH extensions are in active development. The goal: to decrypt your B2B secrets locally, without ever exposing your private key to the server, from Chrome, Firefox, Edge or Opera. The first store release is planned for the course of 2026, followed by the other browsers shortly after. This page honestly documents where we stand and where we are heading.

Follow the progress →
5 targeted browsers Manifest V3 OpenPGP.js v6 AGPL-3.0

Contents

Browsers Features Architecture Roadmap FAQ
02 / What the extension will do

Three functions at the core of the product.

The extension is not an embedded mini-vault: it is a decrypting window onto your remote ARDNTECH vault. The OpenPGP blobs arrive encrypted from the server, and the extension handles local unlocking. The functional scope is deliberately narrow, to remain auditable and uphold our zero-knowledge commitments.

Local zero-knowledge decryption

The ARDNTECH server only delivers encrypted OpenPGP blobs. Decryption takes place entirely within the extension's service worker, via vendored OpenPGP.js v6. The private key is never in server memory, and is kept in the extension only for the duration of the session, then purged by the auto-lock.

 Validated in alpha

Multi-organisation access

An ARDNTECH user typically belongs to several organisations: their personal space, their company, their clients. The extension lets you switch quickly between these contexts without reconnecting. Each vault keeps its own decryption key and its own access policy.

 Next milestone

Autofill + password generator

Automatic filling of login forms and the strong password generator are planned for a later phase. This feature requires extended permissions on the browser side: it will only be enabled with explicit consent and a dedicated internal audit.

 Coming up

03 / Stack and compatibility

Technical architecture.

A deliberately modest and standard stack, to remain readable, auditable and easy to package for the five targeted stores: TypeScript for strict typing, Lit 3 for Web Components, Vite for bundling, vendored OpenPGP.js v6 for the crypto. No exotic dependency, no third-party runtime.

Browser Minimum version Manifest Target store Status
 Chrome 108+ Manifest V3 Chrome Web Store Alpha - Q3 2026
 Edge 108+ Manifest V3 Edge Add-ons Alpha - Q3 2026
 Opera 76+ Manifest V3 Opera Add-ons Alpha - Q3 2026
 Firefox 115 ESR+ Manifest V3 Firefox AMO Alpha - Q3 2026
 Safari 16.4+ Safari Web Extension Mac App Store Roadmap

TypeScript + Lit 3 + Vite

Strict TypeScript, reactive Web Components via Lit 3, build and HMR via Vite. This stack fits on a single page and can be read and audited by any serious front-end developer in less than half a day.

Vendored OpenPGP.js v6

Crypto library audited by Cure53, included in the bundle (no network loading). X25519, Ed25519, AES-256-GCM SEIPDv2 algorithms per RFC 9580. Strictly the same base as the ARDNTECH web application.

Minimal permissions

The extension requests only the strictly necessary permissions: access to the ARDNTECH vault domain (cloud or self-hosted), copying to the clipboard under user action, encrypted local storage for the session. No third-party DOM access, no broad host_permissions by default.

30-second auto-lock

After 30 seconds of inactivity, the extension session is locked and the unlocked private key is purged from memory. The duration is configurable by the user (5 to 600 seconds), with a cautious default. No long-term storage of the master password.

Hardware FIDO2 key compatibility

The extension relies on the same WebAuthn foundation as the web application: any FIDO2 key supported by the browser works to unlock the vault with no additional configuration.

04 / Roadmap

Where we are heading, milestone by milestone.

Four clear stages, with no invented dates. We release when the code clears the internal audit bar, not before. This roadmap is re-evaluated each quarter and the page updated accordingly.

Today

Technical foundations laid

  • Operational Lit 3 + Vite + TypeScript application, reproducible builds for the five targets.
  • Vendored OpenPGP.js v6, round-trip encryption and decryption validated locally.
  • Popup skeleton, master-password unlock screen, auto-lock management.
  • No store release at this stage, internal alpha only.
Next milestone

Vault reading and secure copy

  • Reading OpenPGP blobs from the ARDNTECH instance (public cloud or self-hosted), session authentication.
  • Secure copy to the clipboard under explicit user action, automatic clearing after a few seconds.
  • Auto-lock at 30 s of inactivity (configurable) with effective purging of the private key from memory.
  • First Firefox AMO submission to open, then Chrome Web Store and Edge Add-ons shortly after.
Next phase

Autofill and generator

  • Detection of login forms on sites explicitly authorised by the user, never as a global opt-in.
  • Automatic filling under manual validation, with visual confirmation of the origin of the secret used.
  • Strong password generator (length, character sets, exclusions), direct copy to the vault for immediate reuse.
  • Dedicated internal audit before opening this feature: the extended permissions require a specific security review.
Long term

Safari and Passkeys

  • Safari 16.4+ port with Mac App Store packaging and Apple Developer signing (separate cycle).
  • Passkeys WebAuthn support for passwordless authentication without a master password on compatible devices.
  • Offline mode for read-only viewing of secrets already decrypted within the session.
  • Dedicated extension for mobile browsers (Firefox Android, Kiwi) depending on user demand.
05 / Security model

What the extension sees, does not see, and does.

Three explanatory boxes to qualify the extension's technical trust boundary. This map is verifiable: it follows directly from the Manifest V3 code and the ARDNTECH cryptographic model.

What the extension NEVER sees

Out of reach by design

  • Your master password in plaintext, which is used only to derive the unlock key locally.
  • Your OpenPGP private key in server memory: it never leaves the browser memory.
  • The content of the sites visited: no third-party DOM permission in the manifest by default.
What the extension receives from the server

Stored encrypted, delivered encrypted

  • The encrypted OpenPGP blobs sealed for the connected user's public key.
  • The technical metadata: secret name, folder, dates, owning organisation.
  • The list of organisations the user is a member of, for the switching menu.
What the extension does locally

Decryption and copy

  • Decrypts the OpenPGP blobs in the service worker's RAM.
  • Copies to the clipboard under explicit user action, automatic clearing after a few seconds.
  • Locks the session after 30 s of inactivity (configurable auto-lock).
06 / Frequently asked questions

Five questions from CISOs and users.

The questions most often asked about this extension project. If a question is missing, write to us.

Why are the extensions not yet available on the stores?

Because the alpha is not stabilised. We have chosen to submit the bundles to the stores only once vault reading, local decryption and secure copying have been validated in internal review and by a restricted circle of testers. The first targeted submission is Firefox AMO, whose review cycle is the fastest. No firm date is announced until the alpha is ready: we would rather release late than ship shaky crypto in a browser.

Does the extension read my passwords in plaintext on the sites I visit?

No. The extension has no permission to read the DOM of third-party sites unless the user explicitly triggers an autofill action, a feature that is not shipped in the current alpha. The Manifest V3 manifest requests only access to the ARDNTECH vault domain to retrieve the encrypted blobs and the minimum necessary for secure copying. No keylogger, no form listening, no outbound telemetry is built in. As the code is AGPL-3.0, every requested permission can be audited line by line before installation.

How does local decryption work?

The extension retrieves from the server only encrypted OpenPGP blobs, sealed for the user's public key. Decryption takes place entirely in browser memory, within the extension's service worker, via OpenPGP.js v6 vendored in the bundle. The private key unlocked by the master password remains in the extension's memory for the duration of the session, then is purged by the auto-lock.

Will the extension work with my self-hosted instance?

Yes. The extension is designed to connect to any ARDNTECH instance, public cloud or self-hosted. The instance URL is configured in the extension settings. No dependency on the ARDNTECH cloud infrastructure is hard-coded.

Is the extension's source code public?

Yes. The extension's source code is hosted in the same GitHub repository as ARDNTECH, under the AGPL-3.0 licence. You can audit the manifest, the requested permissions and the cryptographic code before installation. The builds are reproducible.

Stay informed

Get notified as soon as it lands on the store. as soon as it lands on the store.

Leave us your email: we will notify you when the extension is submitted to Firefox AMO. No newsletter, just one email.

Notify me → View the source code
Documented zero-knowledge architecture
Auditable AGPL-3.0 code
Minimal Manifest V3 permissions
First Firefox AMO submission planned for 2026
Self-hosted compatible