Security

When you use a tool that “saves what you type,” the first question should always be: “How do you know what to leave alone?” At Form Recover, we don’t just guess. We’ve built a real-time filtering engine that acts as a gatekeeper for every single field you interact with. To make this process transparent, we’ve categorized our logic into two main layers: Hard Blocks and Soft Blocks. The Real-Time Filtering Engine As soon as you focus on a form field, Form Recover’s engine analyzes it. It doesn’t just look at the type of the field; it scans the entire environment:

When we designed Form Recover, our primary mission was simple: make sure you never lose what you type. By storing everything locally on your device, we eliminated the biggest privacy hurdle—third-party servers. But as we talked to users, we realized that “local” isn’t always private enough. Maybe you share a laptop with a partner, or perhaps you leave your workstation unlocked at the office while you grab a coffee. That’s where the Master Password comes in.

The idea of a browser extension recording everything you type might sound like a “keylogger.” In the wrong hands, that’s exactly what it is. However, for anyone who has lost hours of work to a browser crash, a form recovery tool is a lifesaver. So, how do you balance productivity with security? It comes down to understanding the Threat Model. The Threat Model: What are we protecting against? When you use an extension like Form Recover, you are protecting yourself against:

A form recovery extension is designed to be your safety net, catching the text you type so you never lose a draft again. But a safety net shouldn’t be a fishing net—it shouldn’t just grab everything in its path. To remain secure, a well-designed extension must have strict boundaries. At Form Recover, we believe there are three specific “No-Fly Zones” that an extension should never touch. 1. Password Fields (type="password") This is the most obvious rule, but also the most critical. Any extension that attempts to save data from a field where the characters are obscured (dots or asterisks) is a security risk.