Website access: HTTP and HTTPS pages
Why: to detect likely one-time-code fields, show the local code picker near a matching field, fill the field you select, and apply site-specific recognition rules.
What happens: page signals are evaluated locally. The content script can request codes matching the actual hostname from the extension background, but it does not receive TOTP secrets or WebDAV/S3 credentials.
tabs
Used to identify the active tab and its hostname, open the full management or unlock page, send a fill request to the correct tab, and coordinate user-started field-selection sessions. OTPManager does not upload a tab history.
activeTab
Provides temporary access after an explicit user action. It is used to capture the visible portion of the current tab for QR scanning and to complete user-invoked interactions. Captured pixels are decoded in memory and are not stored or sent to the developer.
storage and unlimitedStorage
storage keeps preferences, temporary unlock-session material, and coordination state. unlimitedStorage prevents the encrypted IndexedDB vault and local encrypted metadata from being evicted by the smaller default extension quota. It does not provide access to arbitrary files on your device.
alarms
Schedules auto-lock checks, optional periodic remote synchronization, and backup maintenance even when the extension user interface is closed. Alarms are internal browser timers; they do not create a developer tracking service.
Optional access to your remote endpoint
When you save or restore a WebDAV/S3 configuration, OTPManager may ask for access to that specific origin where the browser requires it. Requests go directly to your configured endpoint. Credentials and encrypted vault content are used only for the synchronization action you enabled.
What OTPManager does not request
- No microphone, camera, location, contacts, clipboard history, downloads history, or native application access.
- No analytics identifier or advertising permission.
- No access to browser passwords or operating-system keychains.
Permission declarations may change only when a feature genuinely requires them. Material new access will be documented here and in the applicable store review.