How I created an extension that could help you sleep better at night even if your password manager gets hacked

TL;DR

In a nutshell: I built a Chrome extension for a friend called Password Slug to improve the security of his passwords stored in LastPass. He loves it, has been using it every day for the past two weeks, and now swears by it. Although I originally made it for one person, I think Password Slug could be useful for anyone using a password manager. It's free and I don't plan to monetize it. This is one small way I can give back to the global internet community and hopefully make it a tiny bit safer.

Introduction

Howdy, my name is Tommy Doan (commonly written as T. H. Doan in code), and I'm here to share a recent experience launching a brand new product in less than three weeks. However, this story is a little different from a lot of stories on Indie Hackers: from inception I never intended for this product to make money. I mainly built it to fill an immediate need for a friend, and also to learn a new framework I was dabbling in at the time. Besides, it has given me invaluable insights into how to launch something from scratch and build a brand, as I've never done that before as an indie hacker.

Origin Story

At the end of 2022, my buddy Ricky came to me huffing and puffing after the second LastPass data breach incident. He was really frustrated at having to change all his passwords yet again. After talking to Ricky for a bit, somehow the conversation veered into Hollywood movies. You know how in some action thrillers you need two persons to insert a key at the same time in order to launch a missile? At that point we sort of had our eureka moment: what if we apply this same concept to password security?

This was when the seed for Password Slug was sowed. The idea is simple but effective: your password manager stores one part of your passwords in the cloud, and Password Slug stores the other part locally. As soon as your password manager autofills the first part of a password, the Password Slug extension immediately adds the second part of the password, and together they form the complete password. This means that even if your password management company has a data breach, the hackers would only have one portion of your passwords—they would need to have physical access to your computer and know where to look to get the complete passwords, but of course they wouldn't know that. The theory is that the thieves would likely try out the stolen passwords, see that they don't work, then assume that you already changed your passwords and move on to the next target.

I came up with the name "Password Slug" because (1) the text string added to your passwords is kind of like a URL slug (though we're being loose with the definition here since a slug traditionally acts as a unique identifier); (2) the domain passwordslug.com was available; and (3) we love animal mascots!

Code

Being a JavaScript junkie who has been making browser extensions since 2009, this was probably the only leg of the journey where I wasn't outside of my comfort zone (in fact, I usually write code, not English, so posting this itself is something new for me). Before Google Chrome spearheaded the API driven extensions platform, there were Internet Explorer plug-ins and XUL-based Firefox add-ons, both of which were vastly different from each other, significantly increasing the cost of entry for anyone wanting to publish extensions for multiple browsers. I started developing extensions when Chrome Manifest Version 1 (MV1) was introduced. The latest version is MV3, and this is the version Password Slug was developed in. MV3 has opened a can of worms that probably deserves its own article, but by complying to MV3 requirements the Password Slug extension is inherently more secure and future-proof.

Front End

As mentioned in the introduction, part of my motivation for creating Password Slug was to try out a new framework—that framework was Svelte. Having some experience coding in Vue.js when I built Shopify Plus stores in a past life, coming to Svelte was still an uphill climb, although the transition was a welcoming one and the learning curve—even for someone with zero Svelte experience—was not as steep as most other frameworks I've hacked around with, such as React. Like jeans, some fit you better than others, and Svelte happens to fit me as well as a pair of my old tattered jeans ^^. Working in harmony with Svelte is TypeScript, which I chose because it helps you catch errors earlier and encourages better coding practices when developing in VS Code. For the look & feel, I went with daisyUI, a Tailwind CSS plug-in, because up to that point I had never worked with Tailwind CSS before and thought this small project would be a good opportunity to learn it.

In order for Password Slug to autofill the slug immediately after the password manager runs, it needs to monitor the password field for changes. Fortunately, extensions can use what are called content scripts, which are JavaScript scripts that are loaded on every web page and do whatever you code them to do, including performing some action when an input field is changed. This is where Password Slug performs its magic. Since HTML login forms can be coded in countless different ways underneath, autofilling them reliably is not as trivial as it may seem on the surface. You have to simulate human input as much as you can, which involves firing some JavaScript events in a certain order using certain timings to get it just right. Even with my experience developing an autofill extension, there were a rash of idiosyncratic bugs associated with various non-standard forms the first week that I had to troubleshoot and fix. Needless to say, it wasn't a walk in the park to get to where we are today.

Back End

Modern browser extensions do not have a back end—they are built using HTML, CSS, and JavaScript. Data is stored and retrieved via the Storage API (storage.local and storage.sync). Password Slug uses storage.sync to store all settings so that they are synced across every Chrome instance you log in to. The big limitation of storage.sync is that it can only store 102400 bytes worth of JSON data. If Password Slug settings ever exceed this, then I would need to use storage.local, which doesn't sync, or look at a cloud-based back end solution such as Firebase or Supabase.

Build & Deploy

Tying everything together is Vite, which provides excellent tooling for a typical app development environment. With Vite you can easily start a local server that supports hot module replacement (HMR), which means whenever you make a change in your code the app will instantly update without a full page reload. Vite also handles compiling and bundling your source code into smaller files that are optimized for faster loading in web apps.

Launch

Since we are still in private beta testing, technically we're not done with our "launch" yet. If everything goes as planned, Password Slug should officially launch sometime in March. Ricky and I have made some blunders along the way since neither of us have any experience socializing a product. Here are some of the more memorable ones:

• We created a new account to post about Password Slug on a Bitwarden subreddit. Bad move—since the username we created had zero prior posts, and we were posting in a very pro-Bitwarden forum where any perceived implications that Bitwarden might be insecure was considered a threat, the flame came back hot and heavy and our account was banned before either of us had a chance to gasp. I don't remember what the post title was anymore, but it was pretty innocent...something along the lines of "this extension provides extra security."

• In order to cut down on the length of our introduction video, we sped up the speed 1.25x. Some people told us the faster speed and the man's voice (it was generated by a voice AI) made the video sound scammy. Ricky is in the process of redoing that video with a real human voice at a natural speed.

• Our homepage with the faceless hooded hacker as the centerpiece was too threatening for some people, so we are looking to redesign it to be more corporate-y. When dealing with people's passwords, especially in light of all the recent cyber security news, a security product's website needs to project as much trust as possible.

• We didn't account for all the people who use password managers on their phones. For minimal friction to mass adoption we needed to launch with a mobile app also or users would be forced to manually enter the slug, which would get tedious in no time using a soft keyboard. This we can't do anything about since I have no experience building mobile apps, but it's something we are considering if Password Slug takes off (I guess now is the time to start learning Flutter). Ricky and I thought about hiring someone from Fiverr to code the mobile app, but since we are not monetizing this, we felt it wasn't worth the cost out of our own pockets.

Probably our biggest hurdle so far is that our names are not Elon Musk and Jeff Bezos. We are nobodies, and it's super hard to pitch a new security product in this day and age if you're a nobody. In fact, one of the most frequent questions beta testers have asked us was "how do I know Password Slug isn't stealing my passwords?" Good question, which we acknowledged in our FAQ, but it's going to be something that we need to be prepared to answer over and over again as we acquire new users. Of course one option to alleviate this pain point is to open source our project, which we're considering down the road.

Next Steps

Right now Ricky and I are looking to get as many beta testers as we can so that we can iron out all the bugs. Currently only about half a dozen of our close friends are helping us test Password Slug, so if any of you use a password manager, then you're definitely welcome to join the "early access" private beta test. The extension has already been reviewed and approved by Google and is published on the Chrome Web Store, but you won't be able to search for it since it'll be unlisted until the official launch. To install Password Slug, you'll need to go directly to the listing page, which we've created a Switchy redirect link for: install Password Slug. For our next steps, we plan to focus on two areas:

1. On the extension side, I plan to add a Quick Start page that shows up after you install Password Slug. This wizard widget will walk the new user through setting up Password Slug to work with a typical password manager. For the time being, you can watch our video tutorial on how to set up Password Slug with LastPass. When time permits, I will also port the Chrome extension to Firefox and Edge. Thank goodness with the standardization of web extensions, this job should be relatively straight-forward.

2. On the marketing side, we plan to reach out to key influencers (bloggers, editors, etc.) in the security space or who have written about password managers to tell them about Password Slug. This will be a litmus test on how it will be received by the general public. I've already accumulated almost 200 leads, and Ricky and I will start contacting them in the coming weeks. I guess another thing we can do to promote Password Slug is register it as a new product on Indie Hackers and Product Hunt. Any other suggestions on how to spread the word would be much appreciated since this area is not our forte.

That's pretty much where we are right now. If you've made it this far, THANK YOU for taking the time to read about my journey with Ricky. If you read about Password Slug in the news in 2023, then you'll know that we were able to make at least some noise. 😉