Chrome VPN Extension Honesty: Browser-Only Traffic

The download grid is honest if you read the fourth feature on Chrome: browser-only traffic. One-click connect. Works with Chrome. Lightweight. That is the SKU. It is not 'the laptop is covered.' It is not 'every Chromium fork.' It is Chrome, that profile, that extension, traffic the browser actually sends through the proxy the extension set.

People hear VPN and picture the phone app: one Connect, the whole radio. Extensions are not that picture. They sit in the browser process. They can set a proxy. They can claim a tunnel for tabs. They cannot reach into Slack's electron net stack unless Slack is a tab, which desktop Slack is not. They cannot wrap the updater. They cannot wrap a second browser you opened because a site hated Chrome.

I will not write a protocol decoder for the store listing. WireGuard, OpenVPN, OpenConnect, and Shadowsocks are app sentences. The extension is proxy-shaped. If a future build changes that, the download page will change. Until then, treat the tagline as the spec. Browser-only. Full stop.

The compare article will sell you a table of extension versus app. Useful. This page exists because people read the table, install the lighter thing, and then answer 'are you on a VPN?' with yes while Mail.exe fetches in the clear. Honesty is the leftover after the table.

Desktop Slack. Desktop Teams. Discord as an app. Mail clients. The other browser. Background sync. App-store updates. A game launcher. A code editor fetching packages. A password-manager desktop helper. Anything that did not go through that Chrome process. On cafe Wi-Fi, those sockets still look like cafe sockets. HTTPS may still lock the payload. The cafe still gets the hop map for those apps. The extension did not buy you that map.

People mash 'I have a VPN' with 'I have an extension.' Then they join hotel Wi-Fi, open Slack, and feel clever. Slack did not talk to the extension. The how-to public-Wi-Fi article still wants a system tunnel before mail and chat. That advice did not expire because you added a Chrome tile.

A second Chrome profile can be a second story. Extensions are per profile. Work profile without the add-on is clear. Guest Chrome is clear. Incognito may disable extensions unless you allowed it. Check the puzzle-piece menu. Do not assume the toggle you saw in personal Chrome followed you into the window you actually use for banking.

I still want the extension for a locked-down PC where you cannot install a system app. Shared machine, no admin, you only needed to search. That leftover is named. Mail stays in a web tab in that same Chrome, or you skip mail. The moment you open the desktop client, you left the product.

Cloud sync is the quiet one. OneDrive, Dropbox, Google Drive as a desktop helper, iCloud on a Mac: those are not tabs. They talk while you are looking at Chrome feeling protected. On a cafe AP that is a hop map you donated without opening a window you thought about. The same is true for a password-manager helper that is not the web vault. If the process is not Chrome, the extension is not in the path. Say that twice if you have to. Then install the app or close the helpers for the hour.

WebRTC is how a tab makes a call. STUN can ask the LAN for a public IP while you believe the extension hid you. That surprise is documented in the WebRTC plain-English piece. Klox apps list WebRTC leak blocking on the features page. I will not invent that the Chrome extension clones that control. Test if you care. Do not treat a green proxy icon as a STUN mute.

The compare article already warned that extensions can leak WebRTC if they only set a proxy. I am repeating it because honesty posts exist for repetition. A test page can show your home IP in a candidate list while tabs load through the proxy. People screenshot that and declare the store listing a scam. Different mechanism. Different leftover. Read the WebRTC URL. Then decide if the leftover bothers you enough to install the app.

HTTPS versus VPN is the other mash. RFC 8446 locked the page. The extension, when it is working, changed the hop for that tab. Both can be true. Neither wraps Slack. The HTTPS article is the lock. This article is the window. Keep the drawers labeled.

If you never open a page that runs the script, you may never see a WebRTC leftover. Trackers and test pages do run the script. Cafe days are when people test. Test after the extension is on, then test after the system app is on. Expect different pictures. That difference is the point of this URL.

You only browse in that Chrome. Mail is a tab, not an app. Chat is a tab. You are on a machine that will not let you install a system VPN. School image, work laptop with no admin, a library PC you should not install anything on anyway. Wait. Library PCs: do not install random extensions on a profile the next patron inherits. That leftover belongs to the library habit. On your own locked-down work laptop, an extension you control is a narrower leftover.

Quick hop for a site that only needed a different egress IP in that tab. You understand it is that tab. You will not open banking in the mail app during the same session and call it protected. You will not join a cafe and leave Slack on.

Lightweight is real. No TUN adapter prompt. No always-on fight with a printer. Split tunnel, if you even wanted it, is 'this browser versus the universe,' which is a blunt split you can reason about. The app's split tunnel, if the row exists, is a different UI. Do not mash them.

I use the extension when I am already in Chrome and I only needed the tab path. I use the app when I leave the house with a laptop that runs more than Chrome. Both can live on the same machine. Both can confuse you if both are on and you cannot tell which hop a packet used. Prefer one primary. Use the other as an exception you can name.

Cafe Wi-Fi, hotel Wi-Fi, airport, any LAN you do not run, and more than one process talking. That is the app. Kill switch lives there, if your build shows it. Smart Connect on untrusted Wi-Fi lives there. WireGuard first, OpenVPN when the AP is rude: app sentences. Five-device seating is about connected apps, not about how many Chrome profiles you opened.

Phones do not get this extension story. iOS and Android are apps. If your life is a phone plus a laptop, the laptop's Chrome tile does not cover the phone. Two seats if both apps are up. The extension on the laptop does not replace the laptop app if Slack is open. Count processes, not icons.

Remote work that is Slack plus a browser plus a mail client is the app. A 'quick extension' is how you encrypt the LMS tab and donate the hop for the standup. I would rather you download the app once than collect green toggles.

If both are installed, and the app is connected, the extension is often redundant. Redundant can fight. If a site misbehaves, disable one, not both at random, not three settings from a farm GIF. One change, test a site, stop.

Hotel and airport radios still hate UDP. That fight is an app fight: WireGuard, then OpenVPN, often TCP. The extension cannot protocol-hop because I did not invent protocols inside Chrome. If the add-on fails on a rude portal, you still have the splash-page sequence from the cafe habit, and you still have the system client. Do not sit in a lounge debugging a proxy icon while the app would have shaken hands in ten seconds. Download it before you fly. The travel checklist exists for that. This page will not pack your bag. It will say the tile is not the bag.

Klox consumer is five simultaneous devices. Install is free of the counter. Connect is not. The system app is the seat I want you to budget. I will not invent that the Chrome extension is a free extra connection on top of five. I will not invent that it does not count. If you need the accounting for a mixed setup, ask sales. Consumer default: assume anything that holds a live session can cost a seat, and keep the five for apps you can name.

Ghost devices are still how you hit the cap. A tablet at home, a TV, a router. Adding an extension does not magically create a sixth. Removing an extension does not magically free a phone. Open the device list in the portal. Do not debug Chrome when the error is the couch.

Yearly from $2.83 a month does not get cheaper because you only installed an add-on. It does not get more expensive. The 7-day window is still first purchase if you bought a year, then realized you only wanted a proxy in one browser and you resent the rest. Refunds: /refund. Store purchases follow the store. The Chrome Web Store has its own listing and its own complaint path. Use ours for the account. Use Google's for the add-on listing.

I would rather you keep the year and install the Windows or Mac app. The extension can stay as a narrow tool. Seats stay honest. Farms will imply unlimited browser hops. We will not.

The live path is download, Chrome card, Chrome Web Store button. The store URL we ship is https://chromewebstore.google.com/detail/kloxvpn-secure-proxy/cghijemebcphfkipimjcakacdemajgab. Use that listing. A zip on the same download page exists as a secondary. Prefer the store so updates are Google's problem. Do not sideload a 'Klox' CRX a stranger emailed. Phishing an extension is still phishing. A proxy to a thief is still a proxy.

Chrome 88+ is the min line on the card as of this writing. If the store says otherwise, the store wins. Pin the extension if you want to see the icon. Open the details. If it asks for every site, that is how a proxy works. If a listing asks for things that look like a password manager, walk away. Ours is a hop for tabs, not a vault.

Work Chrome may block store installs. Then you do not have this product on that image. Use the system app if policy allows. Use cellular. Do not break MDM to add a proxy. School and work AUPs still apply. This is not a bypass guide.

After install, connect, load a boring site, then optionally a leak test if you care. WebRTC article for the candidate list. HTTPS article if you still think the lock was the tunnel. Then go do the thing you opened Chrome for. Fiddling with cities in an extension is how you get slow and still leave Slack clear.

Farm copy will say a browser extension is a VPN, full stop. Sometimes they bury 'browser only' under a fold. Sometimes they show a laptop silhouette. The silhouette is a lie if Slack is open. Competitor extension pages are useful specimens. Nord and friends will describe their own add-on. Read their leftover sentences. Then read ours. Browser-only traffic is the line I want in the same paragraph as the store button.

I will not rank city counts. I will not promise streaming catalogs I did not promise on the app either. I will not say the extension is safer than the app. Safer at what. Safer at not needing admin. Worse at covering the NIC. Pick the job.

Klox apps remain WireGuard, OpenVPN, OpenConnect, and Shadowsocks, five devices, yearly from $2.83 a month, 7-day first-purchase money-back. Smart Connect and kill switch are app conversations. Cookies on the website: /cookie. Privacy is a different page. The extension does not replace those documents.

If you wanted the matrix, the compare post is next door. If you wanted STUN English, WebRTC. If you wanted the lock versus the hop, HTTPS. If you wanted a tile that only does what it says, download the extension from the store URL, and download the app when the leftover list includes Slack. That is the whole honesty.