Counterfeit extensions copy the name, the logo and the description. What they cannot copy is the identity of the publisher. Four checks, thirty seconds.

1. Where did the link come from?

This is the only check that matters most of the time. Install from the link we sent you. Anything found through a search engine, an advert or a downloaded installer is untrusted by default.

2. Who is the publisher?

Open the extension page in the official store and read the publisher name and website. The real product points to the company’s own domain — not a lookalike with an extra word in it.

3. How many users does it have?

A genuine, well-known password manager has millions of users and tens of thousands of reviews. A counterfeit typically has a few thousand — sometimes a few hundred.

4. Check what is already installed

In your browser open the extensions page and look through the list. If you see something you do not remember installing — especially anything claiming to manage passwords, VPN connections or “security” — do not remove it yet. Send us a screenshot first. How long it has been there tells us how much needs to be changed.