Last updated: 26 September 2026

How we keep you safe

Your new tab is the page you open more than any other, so it should be the last place that spies on you or puts you at risk. Here's exactly how TaboraX is built to protect you — in the extension, in your account, and on our servers.

Only the permissions it needs

Every browser extension lists what it's allowed to do, and your browser shows you that list before you install. TaboraX asks for as little as possible:

  • Your new tab page — so TaboraX can show your shortcuts there.
  • Site icons — to show the icon for each of your shortcuts.
  • Your default search engine — so the search bar can use it.
  • Your location — used only for the weather widget, which you can switch off in Settings.

That's everything at install. TaboraX has no permission to read or change the websites you visit, and no access to your browsing history, bookmarks, downloads or open tabs.

A few features need one more permission, and your browser asks for it only when you first use them: Tabs (to list your open tabs, save them and tidy them up — only while a new tab is open, and nothing about them leaves your device unless you save a session with sync on), blocking sites while you focus (to redirect just the sites you list, only during a session — it never reads those pages), and importing your bookmarks bar or most-visited sites (handed straight back afterwards). You can take any of them back in your browser's extension settings.

Risky links caught before you save them

When you add or edit a shortcut, or type a web address into the search bar, TaboraX checks it with Google Cloud Web Risk, the same kind of protection that helps browsers spot dangerous sites. If the link looks like phishing, malware or unwanted software, you see a clear warning and a link to learn more, and the choice stays yours.

  • You can see it working: as you type an address, a shield in the search bar shows the result — Checking link…, No known threats, Unsafe link, or Couldn't check if the service can't be reached. An unsafe address isn't opened when you press Enter unless you choose Open anyway.
  • Look-alike addresses: scam sites copy real addresses — paypa1.com, g00gle.com, sbi-kyc-update.top. TaboraX compares what you type with well-known sites and your own shortcuts, right in your browser, and shows Look-alike address with the site it imitates. Brand-new scam sites are often not on any list yet, so this catches what a list can't.
  • Short links unmasked: for bit.ly, tinyurl.com and other link shorteners, our server asks the shortener where the link leads — without opening it — and the real address is checked and shown before you go there.
  • Plain searches are never checked or sent to us — only web addresses are.
  • Only the address of that link is checked — nothing else about you or your setup.
  • We don't store the addresses we check.
  • It works whether or not you're signed in.

No protection is perfect: some unsafe sites may not be flagged, and some safe sites may be flagged by mistake. For protection while you browse, keep your browser's own safe browsing switched on.

Private by default

  • No analytics, advertising or tracking — in the extension or on this website.
  • We never sell or share your information for advertising.
  • Without an account, your shortcuts, notes, to-dos and settings stay in your browser and never reach us.
  • Your searches go straight to the search engine you chose, not through us.
  • SafeSearch, when you want it: switch it on in Settings → Search box and TaboraX asks Google, Bing, DuckDuckGo or Brave to filter explicit results. A SafeSearch badge in the search bar shows whenever it's actually being applied — and if your chosen engine can't support it, Settings tells you instead of pretending.
  • Wallpapers you upload stay on your device.

Synced data is end-to-end encrypted

If you sign in to sync, your shortcuts, folders, notes, to-dos, settings and profile photo are locked inside your browser before they are sent to us. Our servers only ever store a sealed copy that we can't open.

  • The key comes from your password. It's worked out on your own device (PBKDF2-SHA-256, 600,000 rounds, with a random salt for your account) and is never sent to us.
  • Strong, standard encryption: AES-GCM with a 256-bit key, built into your browser. A sealed copy that has been tampered with simply won't open.
  • We can't read your synced data — not your notes, not your to-dos, not the sites you've saved. Neither could anyone who got into our servers.
  • The trade-off: because we never have your password or key, we can't unlock your synced data for you. If you reset a forgotten password, what was synced before can't be decrypted, so the copy on the device you reset from becomes your synced copy. Your other devices keep what's saved in their own browser.

Shared groups and TaboraX on the web

  • A shared group is sealed before it leaves your browser, with a new random 256-bit key (AES-GCM). The key is in the link itself, after the # — the part browsers never send to a server — so we store a copy we can't read. Only names and addresses are shared; stopping the share deletes it from our server.
  • The web version unlocks your data in that browser only. On taborax.com/app.html the key is made from your password on that computer, exactly as in the extension, and is never sent. Nothing is saved there, the page can't be kept by the browser's cache, and the sign-in ends when you close it or after 30 quiet minutes — and lasts 12 hours at most in any case.

Your account is protected

Signing in is optional. If you create an account to sync your setup across devices:

  • Confirmed email: we send a 6-digit code to your email before the account is created, so no one can sign up with an address that isn't theirs.
  • Passwords are never stored: we keep only a secure one-way hash (bcrypt). Passwords must be at least 8 characters.
  • Password guessing is blocked: after 5 wrong passwords, sign-in for that account is locked for 15 minutes.
  • One-time codes are short-lived: reset codes expire after 10 minutes, stop working after 5 wrong tries, and can only be requested once a minute.
  • Resetting your password signs out every device, and changing it signs out every other device, in case someone else knew the old one.
  • Sessions expire: you stay signed in for up to 30 days, and logging out ends that session straight away.
  • Safe on shared computers: if someone signs in to a different account on a browser you used, TaboraX never copies your shortcuts, notes or to-dos into their account without asking first. And Log out and remove my data from this browser clears everything from that computer in one step — your synced copy comes back wherever you sign in again.
  • You're in control: you can delete your account and everything synced to it from your profile, after confirming with a code sent to your email.

On our servers

  • Everything sent between TaboraX and our servers is encrypted with HTTPS.
  • Our servers only accept requests from the TaboraX extension and taborax.com, so other websites can't use your session.
  • Database queries are built safely to protect against common attacks such as SQL injection.
  • We only keep what sync needs, as described in our privacy policy.

Keep your account safe

  • Use a password you don't use anywhere else.
  • TaboraX will never ask for your password or a one-time code by phone, chat or email.
  • Install TaboraX only from the Chrome Web Store or taborax.com.

Found a security problem?

If you think you've found a vulnerability in TaboraX, please email connect@taborax.com with "Security" in the subject line, and include the steps to reproduce it. Please give us a chance to fix it before sharing it publicly. We read every report and will let you know what we find.