Catches secrets and regret before they leave your browser.
ShieldVault checks supported secret patterns locally before you submit text in AI chats and other supported browser fields — and gives you a calm beat before you post something you may regret. Protected text is not sent to ShieldVault for detection.
Install ShieldVault free from the Chrome Web Store.
Trick One: Secret Guard — The paste that never happened.
You paste a deploy script into ChatGPT at 11pm. ShieldVault spots the API key inside it, redacts just the secret, and tells you what it caught — before anything is submitted.
- 72 validated detectors: OpenAI, Anthropic, AWS, GitHub, Stripe, database URLs, private keys, and more
- Checksum-verified cards and IBANs — no crying wolf at random numbers
- Surgical redaction: only the secret is removed, your text survives
- Undo/allow-once escape hatch — you stay in control
Trick Two: Regret Check — A beat before you post in anger.
The optional Reputation Guard notices heated, hostile, or late-night posts before they go public — names what it noticed, suggests a calmer rewrite, and starts a short breath timer.
- Local tone check: shouting, insults, threats, passive-aggression
- Deterministic rewrite suggestions generated on-device; protected text is not sent to ShieldVault for detection
- Context-aware cooldown: the hotter the message, the longer the pause
- One click turns it off — it's your voice, we just add a beat
How It Works — Three steps. Local detection.
- You type or paste. ShieldVault watches input events on AI chats and social sites — locally, inside your browser tab.
- It checks on-device. Supported pattern and checksum detectors run in the page. Protected text is not sent to ShieldVault for detection.
- You stay in control. Secrets get redacted with an undo window. Heated posts get a breath timer. You always have the final say.
The privacy promise is the product.
ShieldVault does not perform server-side inspection of protected text. No account is required, and there is no extension telemetry. Your local activity history is metadata only — what category was caught, where, and when — never the protected text itself.
- All detection runs locally
- No account required
- No extension telemetry
- Secret contents never stored
- Minimal permissions
Source-available under the Business Source License (BSL 1.1) — read every line on GitHub.
Coverage — 72 detectors, tuned against false alarms.
Every pattern is validated before it blocks — Luhn checksums for cards, mod-97 for IBANs, context labels for generic keys. Public-by-design identifiers are deliberately ignored, so ShieldVault stays quiet until it matters.
- OpenAI
- Anthropic
- AWS
- GitHub
- GitLab
- Stripe
- Slack
- Discord
- Hugging Face
- Telegram
- DigitalOcean
- HashiCorp Vault
- Tailscale
- Databricks
- Database URLs
- SSH / PGP keys
- JWTs
- Credit cards
- IBANs
- SSNs
- Crypto wallet keys
- And dozens more
Pricing — Free where it counts. Pro where it delights.
Free — $0 forever
- All 72 supported secret and sensitive-data detectors
- Surgical redaction with undo
- Soft review for emails & phone numbers
- Local activity history (metadata only)
- Per-site pause
Pro Monthly — $4.99 per month · cancel anytime
- Everything in Free
- Regret Check — rage, threats, late-night guard
- Local rewrite suggestions on flagged posts
- Context-aware breath-timer cooldown
- Optional sound on block
Pro Lifetime — $39 once · yours forever
- Everything in Pro Monthly
- Pay once, never again
- Saves $20+ vs one year of monthly
- License key works after reinstalls
Already purchased? Activate with your license key from the ShieldVault toolbar popup — no account needed. You can also manage your subscription.
Security guides
- How to prevent API key leaks in ChatGPT
- How to detect secrets before you paste
- How to use AI tools with sensitive data
FAQ — Fair questions.
Does ShieldVault see or store what I type?
Detection runs inside your browser tab, and protected text is not sent to ShieldVault for detection. Limited event metadata — category, site, and time — may be kept locally on your device. License activation contacts ShieldVault, and checkout is handled through Stripe.
What permissions does it need?
Four: activeTab (to know which site you're on when the popup is open), storage (to keep your settings and local activity history on your device), tabs (to open onboarding and extension pages in a new tab), and host access to supported sites so local detection can run inside those pages, plus shieldvault.site for license activation and checkout. Protected input is not sent for detection.
What if it flags something it shouldn't?
Every block has an "allow once" escape hatch scoped to that exact content, and every soft-review category has a one-click "don't warn me again" toggle. Detectors are checksum-validated where possible, so ordinary numbers and words don't trip alarms.
If I buy Monthly, can I switch to Lifetime?
Yes — the upgrade is a $39 one-time payment, started with one click from the extension popup and linked to the same purchase email. Existing subscription billing is managed separately.
What happens to my license if I reinstall?
Your license key keeps working. Enter it in the popup ("I already have a license key") on any new install — no account, no login.