FormVault does not collect, transmit, sell, or share any user data. Everything you enter stays on your own device.

• Your saved field values (the "vault") are encrypted at rest with AES-GCM-256 in the browser's local storage. The encryption key is derived from a passphrase you choose and is held only in memory (session storage) — it is never written to disk or sent anywhere.
• FormVault makes zero network requests. This is enforced by the extension's Content Security Policy, which contains no connect-src. There is no server, no account, no analytics, and no tracking.
• FormVault reads a web page only when you open the popup and click, and only to fill fields you review first. It never submits forms and has no standing access to your browsing unless you explicitly opt a single site in.

Because there is no account and nothing is uploaded, keep your own encrypted backup safe — a forgotten passphrase cannot be recovered.

Full source (MIT): https://github.com/monroju/FormVault