Take your Mozilla vault — passwords and autofill — to any Chromium browser.
End-to-end encrypted with your own Sync key. No FireSync server, no account, no telemetry.
Loading the latest release…
Two routes. The first needs no Developer mode and keeps itself updated.
curl -fsSLO https://dixonsolutions.github.io/FireSync/install.sh
less install.sh # it runs as root; read it first
sudo bash install.shRestart the browser. FireSync installs itself, pins to the toolbar, updates itself from this site, and switches off the browser's own password manager so you do not get two save prompts. No Developer mode involved.
chrome://extensions..crx onto the page and confirm.Quickest way to look at it. No auto-updates on this route.
Stock Chrome refuses off-store .crx files, so use the zip — this works everywhere.
chrome://extensions → Developer mode → Load unpacked.On a managed Chrome — AD, Entra ID, MDM, or a free Chrome Enterprise Core enrolment — the one-command install works there too, Developer mode included.
chrome://settings/autofill — otherwise every login form gives you two save prompts. The one-command install already did this.That is it. FireSync starts syncing immediately.
Firefox Sync is an open, documented, end-to-end encrypted protocol. FireSync speaks it directly from a Chromium extension, so logins you save in Firefox appear in Chrome, and logins you save in Chrome appear back in Firefox. No bridge service, no export file, no third party holding your vault.
Setup is one button. No passphrase, no second account. A passphrase is available in Settings if you want one.
Passwords and addresses over Sync 1.5, with last-writer-wins conflict resolution — the same rule Firefox uses.
FireSync draws its own, because Chrome does not let extensions into the native ones.
Never-save, match strategy, menu behaviour — kept in a private synced collection.
AES-256-GCM under a non-extractable key the browser holds for this extension. Nothing to remember.
An optional bridge reads your profile off disk. No account, no network.
Nothing to breach, nothing to trust. The extension talks to Mozilla and nobody else.
| Browser | Status | How to install |
|---|---|---|
| Chromium | works | Drop in the CRX, load unpacked, --load-extension, or policy |
| Brave · Vivaldi · ungoogled-chromium | works | Same as Chromium |
| Microsoft Edge | works | Load unpacked, or policy with self-hosting |
| Google Chrome | conditional | Developer mode, or enterprise policy on a managed browser |
CRX_REQUIRED_PROOF_MISSING. There is no way to generate one yourself. The
exemptions are developer mode and enterprise policy on a managed browser. Chromium
enforces none of this, which is why it is the recommended target.
Installed with the one-command script? The browser really does update FireSync for you. That was tested rather than assumed: a new version was published, the browser restarted, and it fetched and installed the update unattended in about six seconds. Chrome checks on startup and roughly every five hours.
Loaded unpacked instead? Nothing updates it — Chrome has no mechanism, and no extension can install a new version of itself. That is the main practical reason to prefer the one-command install.
Either way FireSync checks its own release manifest and tells you. The popup shows the running version, whether the browser is managing updates, and a Check for updates button.
| Setting | Default | Behaviour |
|---|---|---|
| Check automatically | on | Reads update.json on a timer |
| How often | 24 h | Clamped to 1 hour – 14 days |
| Update manifest | this site | Repoint it if you self-host or run a fork |
| Never | — | No requests at all; even “Check now” will not override it |
Feeds: update.json (FireSync’s own) · update.xml (Chrome’s enterprise-policy format).
Every platform, first run, uninstalling.
The five layers and how they fit.
Every request, key derivation and record format.
Threat model, key hierarchy, what is not defended.
Detection heuristics and the overlay design.
The optional local helper.
355 tests, and how to try it safely.
Short answers to the obvious questions.
Alpha. The protocol layers are complete and covered end to end against an in-memory Sync server, but have not been exercised against a large real account. Test with a throwaway Mozilla account first, and export your logins from Firefox before you point it at anything you care about.
Credit cards are read-only and off by default. The OAuth client identifier is borrowed from Mozilla, because they offer no way to register one — it works, it is unsanctioned, and it is stated plainly in the notice.