# ZeqPM browser extension (Manifest V3)

Autofill logins from your ZeqPM vault — Chrome, Edge, Brave, and Firefox.

## What it does
- You export your vault from **ZeqPM → My vault → Export backup** (an encrypted `.ZEQ` file).
- You load that file into the extension once and unlock it with your **Zeq password**.
- The extension decrypts the vault **in your browser** (AES‑256‑GCM, HITE) and keeps the
  plaintext only in popup memory. The encrypted blob is cached in `chrome.storage.local`
  so later unlocks need only your password.
- Click **Fill** on any login page and it types your username + password into the form.

## Zero-knowledge / privacy
- **No network, no host permissions.** The manifest requests only `activeTab`, `scripting`,
  and `storage`. The extension never makes a web request and can only touch a page when you
  click **Fill** (activeTab + on-demand injection — no `<all_urls>` content script).
- The plaintext vault never leaves your device and is never written to disk unencrypted.
- The cached blob is the same ciphertext as your `.ZEQ` file; without your Zeq password it is
  unreadable, even to someone with full access to the machine's extension storage.

## Install (unpacked)
1. Unzip `zeqpm-extension.zip` (or use the `extension/` folder directly).
2. **Chrome / Edge / Brave:** open `chrome://extensions`, turn on **Developer mode**,
   click **Load unpacked**, and select the folder.
3. **Firefox:** open `about:debugging#/runtime/this-firefox`, click **Load Temporary Add-on**,
   and select `manifest.json`.

## Use
1. In ZeqPM, **Export backup** to download your `.ZEQ`.
2. Open the extension, **Choose .ZEQ**, enter your **Zeq password**, **Unlock**.
3. On a login page, open the popup — entries for the current site are listed first —
   and click **Fill** (or **Copy password**).

## Keeping it current
The extension reads a point-in-time export. After you add/change entries in ZeqPM
(which sync across your devices), re-export and load the fresh `.ZEQ`, or just **Copy
password** for the occasional new entry. A future version can pull directly from your
Zeq account; this build is deliberately offline-only for maximum privacy.