About Locksy
A powerful browser extension built to give you complete control over your tab privacy. No compromises, no tracking, and 100% offline.
Why Locksy Exists
Locksy was born out of a simple yet urgent need: protecting sensitive browser tabs on shared computers. Whether you're a student in a library, an employee in an open office, or a parent sharing a family computer — there's always a risk of someone seeing tabs you'd rather keep private.
Existing solutions were either too complex, charged money for basic features, or collected user data. Locksy set out to be different: 100% free, completely offline, and privacy-first from day one.
Today, Locksy protects thousands of users across Chrome, Edge, Firefox, Brave, Opera, Vivaldi, and more — all while keeping your data entirely on your device.
The specific problem we set out to solve
Browser security is overwhelmingly designed around remote attackers — phishing pages, malicious scripts, network eavesdroppers. Enormous engineering effort goes into stopping someone on the other side of the world from reading your session. Almost none goes into the far more mundane scenario that actually happens: you are already logged in, your screen is unlocked, and someone else is standing in front of it.
That is the gap Locksy fills, and it is worth being precise about it. Once you have authenticated, your bank dashboard, your work email, your medical portal and your private messages are all sitting in tabs that require no further proof of identity. Every protection you configured has already been satisfied. A colleague borrowing your laptop for “one quick thing,” a family member on the shared desktop, a classmate on the next library machine — none of them need to defeat any encryption to read everything on your screen. They just need to switch tabs.
The operating system's screen lock is the usual answer, and it is a good one when you remember to use it. But it is all-or-nothing and it is disruptive: locking your whole machine to hide one tab means abandoning everything else you were doing. In practice people simply do not do it for a two-minute absence, which is exactly the window in which this kind of exposure occurs. Locksy makes the protection granular enough that using it is not a decision you have to weigh each time — one tab, one domain, or every tab at once, locked in a keystroke and restored the same way.
What We Stand For
Privacy First
Every line of code is written with a privacy-first mindset. We never collect, transmit, or store your personal data.
100% Local
Complete privacy. All encryption keys, databases, and logs stay strictly inside your browser sandbox.
Free Core Tier
Start for free without ads. Enjoy basic tab protection, and optionally upgrade to Pro for advanced features.
Zero Compromise
Military-grade PBKDF2 encryption with 600k iterations. We don't cut corners on security.
Our Journey
Locksy Born
First release on Chrome Web Store with basic tab locking.
Multi-Browser
Expanded to Edge, Firefox, Brave, Opera, and Vivaldi.
v2.0 — Automation
Auto-lock timers and scheduled locking introduced.
v2.3 — Biometrics
WebAuthn/FIDO2 biometric unlock for fingerprint & face ID.
1,000 Users ⭐
Community milestone: 1,000 active users across all browsers.
v2.5 — Stealth Mode
Context menus, stealth mode, and persistent theme toggle.
v3.0 — Intruder Detection
Weekly privacy reports, startup session lock, and local-only webcam capture on failed unlocks.
v3.1 — Privacy Blur Shield
Automatic focus-loss blur, password and card field masking, and per-site blur rules.
v3.3 — Recovery & Sessions
Master Recovery Key for offline account reset, plus bounded sessions with re-auth on sensitive actions.
How it is built, and what “offline” actually means
“Privacy-first” is a claim every extension makes, so here is the architecture rather than the adjective. Your master password is never stored. It is stretched with PBKDF2-HMAC-SHA256 at 600,000 iterations, and only the derived verifier is kept — inside your browser's own storage, on your own device. There is no account to create, no server to sign in to, and no endpoint that receives your password, because no such endpoint exists.
The iteration count is the part worth understanding. Each attempt at guessing your password costs an attacker 600,000 hash operations rather than one, which is what turns a feasible offline attack into an infeasible one. It is also why unlocking takes a perceptible fraction of a second — that delay is the protection working, not a performance defect. Biometric unlock goes through WebAuthn, so a fingerprint or face scan is verified by your operating system's secure hardware and never travels through the extension at all.
Because everything is local, there are consequences we would rather state up front than have you discover later. Nothing syncs between devices; each browser you install Locksy in keeps its own independent configuration. And since we hold no copy of your credentials, we cannot reset your password for you — which is precisely why version 3.3 introduced the Master Recovery Key, a 16-character code you export once and store somewhere safe. It is the only recovery path, and that is a deliberate trade: an account-recovery service would require us to hold something we have chosen not to hold.
How the project pays for itself
A free security extension raises a fair question: what is the business model, and does it involve you? The answer is a Pro tier. Core tab locking, auto-lock timers, biometric unlock and stealth mode are free and stay free. Optional paid features — weekly privacy reports, intruder capture, custom blur rules, startup session lock — fund the work.
What we do not do: sell data, embed third-party trackers in the extension, or show ads inside it. There is no analytics pipeline collecting your browsing history, for the straightforward reason that the extension has nowhere to send it. Sponsorship through GitHub covers part of the cost too, and it is genuinely optional.
What Locksy deliberately does not do
It is not a password manager, and it is not trying to become one. It does not store or fill your credentials — use a dedicated manager for that. It is not a VPN, an antivirus, or a tracker blocker, and it will not defend against malware that has already compromised your operating system.
It defends one thing well: an authenticated browser session against someone with physical access to an unlocked machine. Security tools that claim to solve everything usually solve nothing thoroughly, so we would rather name the boundary than blur it. Our security architecture page documents the cryptography in more detail, including the parts we consider open trade-offs.
About the guides on this site
Alongside the extension we publish 34 long-form guides on browser security — key derivation and password hashing, WebRTC address leaks, referrer policy, extension permission models, passkeys, and the practical side of securing a shared machine. They are written and reviewed by the same person who writes the extension, which means the technical claims come from working on the problem rather than summarising other articles about it.
Where a guide touches on something Locksy sells, we say so in the guide. Where a conclusion argues against using Locksy — and there are cases, like a threat model that calls for full-disk encryption instead — we say that too. Corrections are welcome and get made: if something on this site is wrong, please tell us and we will fix it. You can browse the full archive on the blog or try the free security tools that accompany them.
Ready to Protect Your Tabs?
Join thousands of users who trust Locksy to keep their browser tabs safe. Free forever, no account needed.