Browser extension

Chrome and Firefox extensions (manual install) via Native Messaging — no cloud credential storage.

The QubKey browser extension communicates with the desktop app via a local secure channel (Native Messaging). The flow is: Extension → Native Host → QubKey App → Unlocked vault.

No cloud server, no online account — the extension only works when the desktop app is running and the vault is unlocked.

Browser

WebExtension sandbox — isolated from native processes

QubKey Extension

Popup UI

(search)

Content Script

(auto-fill)

Background Worker

(native messaging)

Native

qubkey-host (Native Messaging Host)

Validates extension origin
Relays to QubKey Desktop via IPC

Desktop

QubKey Desktop

Unlocked vault in memory
Handles requests (get, autofill, generate)

Installation

Before you start

Common prerequisites: install the QubKey desktop app for macOS or Windows, launch it, and unlock the vault. Download the extension package matching your OS on the browser extensions page — macOS and Windows builds are not interchangeable. Extensions are not distributed via the Chrome Web Store, Firefox Add-ons, or other public stores.

Download passmanager-chrome-1.0.0.zip for your platform from /en/browser-extensions
Extract the archive to a fixed folder (manifest.json at the root)
Open chrome://extensions (or edge://extensions for Edge/Chromium) → enable Developer mode → Load unpacked
Configure Native Messaging (com.passmanager.native.json) and copy the extension ID into the host manifest
Unlock QubKey — the extension options page should show Connected

Download passmanager-firefox-1.0.0.xpi for your platform from /en/browser-extensions
Local testing: open about:debugging → This Firefox → Load Temporary Add-on → select manifest.json (extracted from the .xpi)
On Firefox Release, an unsigned .xpi is usually rejected — AMO publication enables one-click install once the build is signed
Configure Native Messaging for Firefox — see the Native Messaging guide (%APPDATA%\Mozilla\NativeMessagingHosts\ on Windows, equivalent folders on macOS)
Unlock QubKey → Settings → Extension should show Connected

Other browsers

Chromium browsers (Chrome, Brave, Edge, Opera) use the same extracted .zip package — load the folder from chrome://extensions or edge://extensions. Safari has no QubKey extension package on the site.

Architecture

Local architecture

Native Messaging: the extension sends requests via stdin/stdout to a local process (Native Host), which relays to the QubKey app.

No data travels over the internet
The .rkvey vault stays on your disk
The extension never has access to the master password or raw keys
A session JWT token (15 min) limits the access window

Features

Security model

Mechanism	Type	Protection
`Native Messaging`	`IPC`	Local stdin/stdout communication — no network port opened
`Session Token`	`JWT`	HMAC-signed token, expires after 15 min inactivity — limits extension access window
`Permissions`	`Minimal`	No history, cookies, inactive tabs access — current page only
`Content Script`	`Isolated`	Runs in an isolated world — separate from the page's JavaScript

Troubleshooting

"Cannot connect"

Check the desktop app is running and the vault unlocked
Verify the extension package (macOS vs Windows)
Check the Native Messaging manifest and extension ID
Restart the extension (disable/re-enable)

Guide: browser extensions page

"Native host not found"

The Native Messaging manifest (com.passmanager.native.json) is not registered or the extension ID is wrong. Follow the Native Messaging section on the browser extensions page.

Fields not detected

1. Right-click → "Fill with QubKey" 2. Verify the URL is saved in the entry 3. iFrames are not accessible — manual fill 4. Temporarily disable other password managers