Bandwidth Lens

Bandwidth Lens Security & Privacy

A plain-language and technical account of the permissions, storage, and network behavior verified for Bandwidth Lens.

Last reviewed: July 10, 2026

This documentation applies to reviewed version 1.0.2. It may be updated when the extension changes.

What Bandwidth Lens measures

Bandwidth Lens estimates the upload and download traffic associated with a browser tab. It groups byte estimates by website hostname and resource category, such as HTML, images, media, scripts, styles, fonts, data, and streams.

It uses request-body byte length for upload estimates and the Content-Length response header when available for download estimates. Caching, compression, missing headers, and streaming can make these practical estimates differ from a network provider's totals.

Permissions and reasons

These permissions are taken from the reviewed version 1.0.2 manifest. The reason column describes how the corresponding implementation uses each capability.

Bandwidth Lens permissions reviewed from the current manifest and source
Permission	Why it is required	Can related extension data leave the device?
`storage`	Saves settings, open-tab sessions, and daily per-site bandwidth totals in Chrome local storage.	No
`tabs`	Identifies the active tab, maintains per-tab measurements, updates the badge, and removes a saved tab session when its tab closes.	No
`webRequest`	Reads request and response metadata to estimate upload and download byte totals without blocking or changing requests.	No
`Host access: all HTTP and HTTPS sites`	Lets the extension measure traffic and show its optional meter on whichever website the user visits.	No

Storage, retention, and control

The extension stores settings, daily hostname-level aggregate byte totals, and open-tab session records in chrome.storage.local. A tab record can contain its title, URL, hostname, request count, timestamps, totals, and category breakdown.

Daily usage records older than 35 days are pruned. Open-tab sessions are removed when their tab closes. Users can clear a site's saved totals, all saved report totals, all tab sessions, or reset one tab from the extension interface. Export actions create a local CSV or JSON download only when the user requests one.

Data and accounts

Measurements and settings remain in Chrome local storage in the reviewed code. No Practical Builds server receives extension data, and no account is required. The code calculates request-body size but does not retain request-body contents.

Analytics and remote code

No analytics or telemetry code was found. Executable code ships inside the extension package. No remote scripts, external API calls, runtime third-party libraries, eval, or new Function were found.

Technical implementation summary

Manifest V3 service worker with packaged popup, report, and content scripts.
chrome.webRequest.onBeforeRequest reads request-body metadata for upload byte estimates.
chrome.webRequest.onCompleted reads response headers for Content-Length download estimates.
Hostnames and aggregate measurements are persisted under dated usage keys in chrome.storage.local.
The all-site content script renders the optional bandwidth meter and exchanges measurements with the packaged service worker.

Links

Chrome Web Store Practical Builds privacy policy Extension Auditor report Portfolio security and transparency

Third-party analysis is independent, is not controlled by Practical Builds, and may change over time.

Responsible disclosure

If you believe you have found a security or privacy issue in a Practical Builds product, please contact us with a clear description, reproduction steps, and the affected extension version. Please avoid accessing or retaining data that does not belong to you.

Email [email protected] or use the support page.