Learn one feature at a time
A random page of the ORGanizer documentation, so you pick up something new without reading all of it at once.
Encryption
ORGanizer stores Salesforce passwords and security tokens. Encryption is what stands between those and anyone with access to your browser profile. Turn it on from Options → Encryption and pick a master password.
Read this before you store anything
ORGanizer is a productivity tool, not a certified password manager, and storing credentials was never the point of it — it is a convenience built around the logins you open twenty times a day. This is what the popup tells you as well: storing credentials in a browser extension is not 100% secure, and you are responsible for the security of your own browser.
So keep the line where it belongs. Use ORGanizer for the environments where a leak would be an inconvenience rather than an incident: scratch orgs, developer editions, sandboxes, the test users you rotate through. Production admin accounts, anything covered by an NDA and anything your company's security policy has an opinion about belong in the vault your organisation approved — not here.
With great power comes great responsibility. You are a power user: use the tools you have responsibly, inside your own rules of engagement and whatever you have signed.
Rebuilt in 1.0
The old scheme derived its key with a single MD5 pass and encrypted with unauthenticated AES-CBC. Version 1.0 replaces it end to end with the browser's own Web Crypto API.
| Before | 1.0 | |
|---|---|---|
| Key derivation | EvpKDF, MD5, one iteration | PBKDF2-SHA256, 600,000 iterations, 16-byte random salt |
| Encryption | AES-CBC, no authentication | AES-GCM 256-bit, fresh 12-byte IV per value, built-in authentication tag |
| Password verification | A reversible hash of the password | A one-way verifier: a known token, encrypted |
| Where the key lives | Encrypted, but on disk | In memory only, inside the background worker |
The consequence of that last row is the one you will notice: the derived key never leaves the background worker and is never written anywhere. When the browser closes, the extension reloads or the worker goes idle, the key is gone and ORGanizer asks for your master password again the next time it needs to decrypt something. Every password and token is encrypted individually, so one value can be revealed without unlocking the rest.
There is no recovery
Nobody — including the author of the extension — can recover your master password or decrypt your vault without it. Keep a copy somewhere safe, and take an export before you change it.
Migrating an existing vault
If you were already using encryption, the popup shows a banner pointing at a guided migration page. It re-encrypts your stored credentials with the new scheme after you enter your existing password. On a second device that syncs the migrated data, ORGanizer detects the new format and migrates the local copy automatically once you unlock it.
Mixed states are handled: a device still running an older build can keep working while another has already migrated, and nothing is overwritten in a way that would strand the other device.
Removed in 1.0
Timed Password Sessions are gone. They existed to keep a decrypted password usable for a set number of minutes; with the key now held only in the background worker's memory, the worker's own lifetime is the session, and a second timer on top of it would only have weakened the guarantee.
Show me another one