Skip to content
Last updated 2026-11-05

What Is an Extension Wallet?

An extension wallet runs inside your browser and puts a signing window on top of the pages you visit. This page explains the permissions that design creates and how to keep a browser wallet from becoming your weakest link.

Who this is for

People who use a desktop browser wallet, and anyone who installed an extension after following a link from a chat, a video, or a search ad.

What it is

A browser extension wallet is a small program installed in Chrome, Brave, Edge, or Firefox. It stores keys locally in encrypted form and provides a popup where you approve connections, signatures, and transactions. It also injects a provider into pages, which is how a site can ask your wallet to do something.

The permission model has two layers: on the site layer, each connection is tied to a domain, and you approve it once. On the browser layer, the extension holds permissions that let it read and change data on the pages you open. Every tab shares the same extension and the same unlocked session.

A typical session looks like this: you open a swap site, click connect, and the popup names the domain. You approve, then approve an allowance, then confirm the swap. Each prompt shows the domain, the network, and the details, and that popup is the only part of the screen you can trust when a page is lying to you.

Why it matters

The convenience is real. A browser wallet works with the Console at app.bitgold.network, where signing in is a free signature rather than a password, and it does not need a phone. The cost is that the browser is the most attacked surface on a computer.

Fake extensions exist. Clones copy a real wallet's name and logo, sometimes with a slightly different publisher, and capture the recovery phrase during setup. A malicious extension can also read page content and change what you see, which is why the popup rather than the page is your reference.

The practical routine is short. Verify the publisher and the official domain before installing, review the permissions the extension requests, remove extensions you no longer use, and disconnect sites when you are done. Disconnecting ends the session; it does not cancel token approvals, which live on the chain and need a separate revocation.

Common misunderstandings

  • "If the site looks right, the popup must be safe." The popup is the trustworthy side of the exchange. Check the domain and network inside it, not the page behind it.
  • "Extensions are isolated per tab." One extension serves every tab with one session. An unlocked wallet in one tab is unlocked for all of them.
  • "Disconnecting from a site removes its approvals." Disconnecting ends the session. Allowances remain until you revoke them.
  • "A store badge proves the extension is official." Store listings are copied and imitated. Check the publisher and confirm the address from the official site.

Key takeaways

  • An extension wallet lives in the browser and signs from keys stored on that computer.
  • Every tab shares the extension, so one bad page can reach the same wallet.
  • Fake extensions are a common route to phrase theft; verify the publisher.
  • Disconnect sites after use, and revoke approvals separately.

Next steps