Briefed
How it works Security Philosophy Pricing Prompt Pass
Add to Chrome · Free
Security

Every claim on this page can be checked without trusting us.

Briefed says your context never leaves your computer. So does a lot of software that turns out to be lying. This page exists so you don't have to take the sentence on faith.

Check it yourself See the permission list
As shipped in version 2.1.2
Two permissions · no host permissions
This is the whole permission list
manifest.json v2.1.2
{
"manifest_version": 3,
"permissions": [
"storage",
"sidePanel"
],
"host_permissions": [],
"content_scripts": []
}
Chrome shows the same list under Permissions on the Web Store
No host permissions
No content scripts
No network code
No telemetry
Briefed never phones home
Permissions

What the extension is allowed to do

This is the full permission list from the manifest, as shipped in version 2.1.2. Chrome shows the same list on the Web Store listing under Permissions, and again under Details on your own chrome://extensions page.
storage
Lets Briefed write to chrome.storage.local. This is where the encrypted vault lives, on your disk, inside your Chrome profile.
sidePanel
Lets Briefed draw its panel next to whatever page you're on.
That's the whole list. There are no host permissions.
What that means in practice: Briefed cannot read the page you're on, cannot see what you type into ChatGPT, Claude or any other site, cannot inject scripts, cannot intercept requests, and cannot attach a debugger. The browser doesn't let it, because it never asked.
Why those absences matter
Those absences aren't decorative. Palo Alto's Unit 42 analysed 18 high-risk GenAI browser extensions in April 2026 and found that the ones stealing prompts and API keys relied on <all_urls> access, content script injection, webRequest interception and the debugger protocol. One of them advertised "100% local processing, your data never leaves your browser" while holding an open connection to a command server. Briefed requests none of those permissions, and the manifest is where you check that, not the marketing copy.
No network code

Nothing phones home, because nothing is written to.

There is no analytics, no telemetry, no crash reporting, no update ping and no license check. See also the privacy page.
fetch()
Not present
XMLHttpRequest
Not present
WebSocket
Not present
sendBeacon()
Not present
The extension's source contains no fetch, no XMLHttpRequest, no WebSocket and no sendBeacon. The only external URL in the product is the Gumroad purchase page, which opens when you click the buy link.
Check it yourself

Three ways, in increasing effort.

01
Read the manifest
Chrome unpacks every installed extension into your profile folder. Find Briefed's folder under Extensions, open manifest.json, and compare it to the list above.
02
Grep the source
In the same folder, search the JavaScript for fetch(, XMLHttpRequest, WebSocket and sendBeacon. You'll find none.
03
Watch the network tab
On chrome://extensions, open Briefed's Details and click Inspect views for the side panel. Open the Network tab, then use Briefed through a full session: unlock, generate a briefing, save. The tab stays empty.
One thing you may see elsewhere: Chrome checks the Web Store for extension updates on its own schedule. That's the browser's request, made for every extension you have installed, not a call Briefed makes, and it carries nothing from your vault.
The vault

How your vault is encrypted.

Parameters, and the reasoning behind each one.
AES-256-GCM
Authenticated encryption. It doesn't just hide the contents, it detects tampering. If one byte of the vault changes, decryption fails instead of returning something plausible. Nobody with access to your disk can quietly edit one entry.
PBKDF2-SHA256, 600,000 iterations
A password isn't a key. This turns one into the other deliberately slowly, so every guess an attacker makes costs them 600,000 hash operations. That's the current OWASP recommendation for this function.
Why PBKDF2 and not a memory-hard function like Argon2id: PBKDF2 ships natively in the browser's Web Crypto API, with no third-party code in the path between your password and your key. At 600,000 iterations it meets the published standard for the function in use.
32-byte random salt, per vault
Two people with the same password get different keys.
12-byte random IV, per save
Regenerated every time the vault is written, never reused.
The iteration count is stored in the vault
Alongside the salt and IV. Each vault records how it was made, which is how the count was raised from 310,000 to 600,000 without breaking anything already encrypted. A vault claiming an unreasonable count is refused rather than run.
Passwords
Minimum 12 characters. Scoring is by length, not by symbol rules, because length is what actually adds entropy. Four or five random words beats any twelve-character password you'd remember. There's also a short blocklist of the passwords that sail through on length alone, and it's compiled into the extension. The check runs against an in-memory list in the same function where you typed. Nothing about your password, not even a hash of it, is transmitted, because there is no network code to transmit it with.
What we don't have

The limits, stated plainly.

No third-party audit
Everything above is checkable by you, and that's the point of this page, but nobody outside Briefed has been paid to check it. Obsidian has two published audits. We have this page.
No password recovery
There's no account, no server and no reset. If you lose the password, the vault is gone. That isn't a policy. It's a consequence of never having the key.
No sync, no mobile, Chrome only
The vault is a file on one computer. Moving it is your job. USB and AirDrop leave no copies behind. Email and cloud drives do: the file is encrypted wherever it sits, but every service it passes through keeps its own copy, in backups and sync history you don't control and can't delete.
Local storage doesn't make a briefing private from the AI you paste it into
Once it's in ChatGPT, it's in ChatGPT. No tool in this category can claim otherwise, and we won't.

Two permissions. No host permissions. Check for yourself.

Add to Chrome · Free Read the Philosophy page
Briefed
How it works Security Philosophy Pricing Flipside Prompt Pass Field Notes Privacy policy Support
© 2026 Briefed · Never phones home.