Chrome · Edge · Brave · Opera · Firefox · Free · No account
Two clicks instead of ten
A verification code normally costs ten gestures and two tabs: copy, switch, paste, come back, wait, switch again, find it, copy, come back, paste. With the extension it is one click for the address, one for the code — and you never leave the page you were on.
In the page
It works where the form is
Nothing to open, nothing to copy across, no second tab.
-
01
Click in an email field
The chip appears under the field — never inside it, which is where password managers live. Come back to the same site tomorrow and it offers the same address, because people log back in more often than they sign up.
-
02
It waits for the mail
Every three seconds at first, then every ten, then every thirty — and it stops after half an hour and says so. A poll that gives up in silence leaves someone waiting in front of a screen that stopped looking.
-
03
The code lands where you need it
One click fills the code field — including the kind split into one box per digit. And when two candidate numbers look equally plausible it says nothing: a wrong code offered in one click is worse than no code.
Install
Three steps, once
It is not on the Chrome Web Store yet, and Chrome stopped installing extensions from a downloaded file years ago. Until it is listed, the folder is loaded by hand — which takes about a minute and never has to be done again.
Also Edge, Brave, Opera, Vivaldi — same engine, same package.
Download the folder1.1.0 · 29 files · 92 KB · built Sep 2, 2026
The same code runs there. What is missing is a signature, not a port.
Download the folder1.1.0 · 29 files · 92 KB · built Sep 2, 2026
Chrome · Edge · Brave · Opera · Vivaldi
-
Unzip it somewhere it can stay
Chrome reads that folder every time it starts, so it has to keep existing. The Downloads folder is a bad place for that.
-
Open the extensions page, turn on developer mode
Paste in the address barchrome://extensionsThe switch is at the top right. On Edge it is at the bottom left, and it is called the same thing.
-
Load unpacked, and pick the folder
The one that contains
manifest.json— not the zip, and not its parent. That is the whole installation.SHA-256 — this build is signed by nobody, so here is what it should beb75f4d525e2b04c7f157db67bcc70d487176910107c42ce39dbc79ccff062efc
Firefox
-
Open the debugging page
Paste in the address barabout:debugging#/runtime/this-firefox -
Load Temporary Add-on, and pick the zip
No need to unzip it. It lasts until Firefox restarts — a signed build, installable for good, is on its way through addons.mozilla.org.
SHA-256 — this build is signed by nobody, so here is what it should be87d00f63753db7101644b65dd002e77b0f5e003d8326ab295f6455c9c8acf06a
Permissions
What it can see
An extension that fills forms could read every page you open. This one is built so that it cannot.
- It does not read the page
- It writes into the field you point it at, and watches for an error message for twenty-five seconds after a fill. Nothing else is looked at, and nothing leaves the browser.
- The part running inside pages has no API key
- It asks the extension for “an address for this site” and gets back a string. A page that hijacked it would learn only the address you were about to type into its own form.
- We never learn where you sign up
- The site-to-address list lives in your browser. grabmail.io sees address lookups and nothing else — not which page you were on.
- Three permissions, and they are checked
- Storage, alarms, and one context-menu entry. A test refuses to build the package if a permission is requested without being used.
When a form refuses the address
The public domains are on the public disposable-mail blocklists, so a fair share of signup forms reject them. The extension notices, says so on the spot, and offers the private pool instead — the only moment it ever mentions a paid plan. Add your API key once and the picker unlocks.