Manifest V3 · Chrome Extension

Lock any website
behind a password.

Site Lock intercepts navigation before page content renders and sends it to a challenge screen. Protect distractions, dashboards, or private tools with a single master password.

Add to Chrome — Free See how it works

Available on the Chrome Web Store · Works on Chrome, Edge, Brave & other Chromium browsers

  • PBKDF2SHA-256 · 100k iterations
  • 0data sent off device
  • 5 min – ∞session timeouts
Features

Everything you need to guard a tab

Domain & path locking

Protect a whole domain (youtube.com) or a specific path (example.com/admin).

Pre-render interception

Dynamic declarativeNetRequest redirect rules stop the page before any content loads.

Master password unlock

One password, stored only as a PBKDF2 hash with a unique per-install salt.

Session timeouts

Stay unlocked for 5 min, 15 min, 30 min, 1 hour — or for the whole browser session.

Lockout protection

Three wrong attempts trigger Access Denied plus a 5-minute cooldown applied across all tabs.

Popup quick actions

See current tab state, unlock, protect the current site, or hit Lock Now to end a session instantly.

How it works

Four steps, no servers involved

  1. 01

    Site protection rule

    Adding a site stores a normalized domain/path and generates a regex filter, synced into dynamic rules by the background worker.

  2. 02

    Navigation interception

    Navigating to a protected URL redirects the tab to the lock challenge page. The original target URL is kept in session storage.

  3. 03

    Password verification

    On a valid password a high-priority allow rule is added, the unlock timestamp is saved, and an expiry alarm is scheduled.

  4. 04

    Lockout & expiry

    Wrong attempts trigger a cooldown. Temporary unlock rules are removed on timeout or when you press Lock Now.

Recommended

Install from the Chrome Web Store

  1. Click Add to Chrome and confirm Add extension
  2. Pin Site Lock to your toolbar from the puzzle-piece menu
  3. Open Options and set your master password
  4. Add the sites you want protected and pick a session timeout
Add to Chrome
For developers

Load unpacked

  1. Open chrome://extensions
  2. Enable Developer mode
  3. Click Load unpacked
  4. Select the cloned project folder
Get the source
Privacy Policy

Your data never leaves your browser

Last updated: 14 August 2026

1. Data we collect

None. Site Lock has no analytics, no telemetry, no accounts, and no remote server. Nothing you do in the extension is transmitted anywhere.

2. Data stored locally

  • Your master password hash (PBKDF2 / SHA-256, 100,000 iterations) and its unique salt — the plain password is never stored.
  • The list of protected domains and paths you add.
  • Your selected session timeout preference.
  • Temporary session data: active unlock timestamps, pending navigation URL, and failed-attempt counters.

All of this lives in Chrome's storage API on your device and is removed when you uninstall the extension or reset protection.

3. Permissions and why they are needed

  • storageSave password hash, rules and configuration.
  • webNavigationCapture the pending navigation URL so you can be returned to it after unlocking.
  • declarativeNetRequestCreate the redirect and allow rules that lock/unlock sites.
  • declarativeNetRequestFeedbackDebug rule behaviour during development.
  • alarmsSchedule session expiration timers.
  • tabsRead the current tab context for the popup and lock page.
  • host_permissions <all_urls>Required so you can protect any website you choose. Page content is never read or stored.

4. Browsing history

Site Lock does not record, log, or transmit your browsing history. URLs are matched locally against your own rule list only at the moment of navigation.

5. Third parties

No third-party SDKs, trackers, ads, or external network requests are included. Your data is never sold or shared, because it is never collected.

6. Your control

You can change your master password, remove protected sites, reset protection entirely, or uninstall the extension at any time — each of which clears the associated local data.

About

Built as a focused, open-source tool

Site Lock: Web Guard is a Manifest V3 Chrome extension that password-protects selected websites and URLs with custom site redirection, SHA-256 based authentication, and session control.

It was created to solve a simple problem: browser blockers are easy to click past. Site Lock replaces a "are you sure?" prompt with a real cryptographic challenge, so an intentional password entry is the only way through.

Open source · JavaScript, CSS & HTML · MIT-friendly workflow via GitHub.

Add to Chrome Source code