Session hijacking
stops here.
A malicious script only needs two things to steal your session: read your token out of storage, then send it somewhere. Utilvo TokenGuard blocks both — in real time, on every site, for free.
Works in Chrome, Edge & Brave · Not yet on the Web Store — see why below
Faithful recreation of TokenGuard's real popup — your own counters start at zero on install.
What interception actually looks like
Not every script on the page is trustworthy
A compromised ad, a hijacked third-party widget, an injected payload — TokenGuard inspects where the call actually came from, not just what it's asking for.
- Same-origin reads — your site's own login flow — are never touched
- Cross-origin reads of sensitive keys are blocked and logged instantly
- Cookie access gets the same scrutiny as localStorage and sessionStorage
- fetch() carrying a bearer token or JWT
- XMLHttpRequest with an Authorization header
- WebSocket connections containing a token in the URL
- navigator.sendBeacon() fire-and-forget exfiltration
Every exit door, covered
Even if a token gets read, it still has to leave your browser to be useful to an attacker. TokenGuard hooks all four real network primitives a page can use to send data out — not just the common ones.
- fetch() carrying a bearer token or JWT
- XMLHttpRequest with an Authorization header
- WebSocket connections containing a token in the URL
- navigator.sendBeacon() fire-and-forget exfiltration
What it caught stays encrypted until you say so
High-severity evidence — exactly what a blocked script tried to read or send — is encrypted with AES-GCM before it ever touches disk. Lock the vault and it's unreadable, even to something else on your machine, until you unlock it again.
- AES-GCM 256-bit — authenticated encryption, not just obfuscation.
- PBKDF2, 100,000 iterations — your passphrase is never stored, only derived from.
- Auto-lock on idle — timing set by your sensitivity preset.
Faithful recreations of TokenGuard's real UI — not placeholder mockups.
Everything running underneath
No feature here is aspirational — each one maps to actual code.
Cross-Origin Storage Sniffing Blocked
Reads localStorage, sessionStorage, and cookies by a script from a different origin than the page — the real signature of an injected/compromised script hunting for your session.
Network Exfiltration Blocking
Fetch, XMLHttpRequest, WebSocket, and sendBeacon calls carrying a bearer token, JWT, or API key to an unrecognized third-party domain are blocked before the request leaves your browser.
AES-GCM Encrypted Vault
256-bit AES-GCM with PBKDF2 (100,000 iterations) protects sensitive audit evidence at rest — locked, the details of what was caught stay unreadable until you unlock with your passphrase.
Three Sensitivity Presets
Low, Balanced, or Paranoid — trading off confirmation prompts and auto-lock timing against how much friction you want on unfamiliar cross-origin requests.
Your Own SaaS Whitelist
Add the API and analytics endpoints you actually trust — Stripe, Sentry, your own backend — so legitimate cross-origin calls never get flagged.
Pause Anytime, Everywhere
One toggle pauses protection across every open tab immediately — no per-site fiddling when you need to debug something yourself.
Protects Tabs You Already Had Open
Installing or updating the extension retroactively arms every tab that was already open — most extensions leave those unprotected until you refresh.
Real-Time Security Feed
Every blocked attempt appears in the popup instantly — domain, what it tried to read or send, and when — not buried in a log you have to go looking for.
Full Audit Dashboard
A searchable history of every interception, plus the whitelist editor and sensitivity controls, in one control panel.
Not on the Web Store yet — here's why that's fine
TokenGuard ships straight to you instead of waiting on store review — four clicks, no restart.
Download the extension
Grab the .zip package below — no Chrome Web Store account or install fee.
Unzip it locally
Extract the archive to any folder and keep it there — Chrome loads the extension from this folder.
Open chrome://extensions
Enable "Developer mode" using the toggle in the top-right corner.
Load unpacked
Click "Load unpacked," select the folder. TokenGuard arms every open tab immediately — no restart needed.
What changes when it's running
A standard browser has no concept of "this script shouldn't be touching that token."
Privacy, in two sentences
Storage access calls and outgoing network requests, checked locally for token-shaped patterns and cross-origin signals. Nothing is sent to a server for analysis.
Whitelist any endpoint you trust, pause protection entirely when you're debugging, and the encrypted vault means only you can read what was captured.
Frequently asked questions
What exactly is TokenGuard protecting against?
Session tokens, JWTs, and API keys are what actually keep you logged in after a real password check — if a malicious or compromised script on a page can read one out of storage and send it to its own server, it can impersonate you without ever seeing your password. TokenGuard watches for both halves of that attack: the read, and the send.
Does it stop every possible way a token could leak?
No single tool does, and we won't claim otherwise. TokenGuard's storage guard is strongest against cross-origin script sources — an injected ad, a compromised third-party widget. The network guard blocks exfiltration attempts regardless of where the reading script came from, which is why it's the layer that matters most: even if a token gets read, it still has to leave your browser to be useful to an attacker.
Will it break login on sites I actually use?
A site storing and reading its own token on its own origin is normal, expected behavior — TokenGuard never blocks that. It only intervenes when a script from a different origin touches your storage, or when a request is carrying a token to a domain you haven't whitelisted.
What happens when I lock the vault?
New high-severity findings keep being captured, but their sensitive detail is encrypted and shown as locked in the audit feed until you unlock with your passphrase. Detection and blocking keep running while locked — locking only affects whether you can currently read the evidence.
Why isn't this on the Chrome Web Store yet?
TokenGuard is in active development. Rather than wait for store review, we're shipping the current build directly so early users can try it now — install takes under a minute via Chrome's Developer Mode.
What's the difference between Low, Balanced, and Paranoid?
All three block the same categories of attempt — the difference is friction and timing. Low never prompts and auto-locks the vault after 30 minutes idle. Balanced prompts on requests to genuinely unrecognized domains and locks after 15 minutes. Paranoid prompts more readily and locks after 5 minutes.
More from Utilvo Labs
Blocks dangerous links, downloads, and phishing pages before they ever load.
Preview suspicious links in a fully isolated, monitored frame — nothing touches your real browser.
Flags fake login pages that mimic sites you trust — before you type your password.
Install it before the next tab you sign into
Free, local-first, and ready in under a minute — no Chrome Web Store account, no signup.