MailKey
In development — preparing for Chrome Web Store reviewMailKey is a Chrome extension that fills email verification codes for you.
The code youjust asked for,one click away.
Apple's SMS autofill, moved to email. MailKey is a Chrome extension that reads only the last hour of your Gmail, finds the verification code that just arrived, and offers to fill it in. Nothing is stored, nothing is sent anywhere, and nothing happens until you click.
- Platform
- Chrome Extension
- Access
- Gmail, read-only
- Backend
- None
Enter the 6-digit code we emailed you
Three moments, and only one of them is yours.
- 01
The code arrives
You ask a site to email you a verification code. It lands in Gmail like it always does — MailKey changes nothing about that.
- 02
MailKey spots it
Because a code field is on screen, the extension asks Gmail for mail from the last 60 minutes only, reads it in memory, and pulls out the code.
- 03
You click Fill
The code appears in a chip beside the field, with the domain it came from. One click puts it in the box. It is never typed for you, and never submitted for you.
Small surface, stated exactly.
- Read-only Gmail access, granted through Chrome
- Only ever asks Google for mail from the last 60 minutes
- One click to fill — never automatic, never submitted for you
- Shows the sending domain next to the code
- The code lives in session memory for 60 seconds, then is wiped
- Email bodies are parsed in memory and discarded
- No backend, no analytics, nothing leaves your device
- Runs on every site, or only the ones you list
The honest version.
MailKey exists because verification codes are annoying, not because anyone needs another thing reading their mail. So the constraints are written down — including the one Google cannot enforce for you.
Read the full privacy policy- Read-only
- Access is granted through Chrome itself (chrome.identity), scoped to gmail.readonly. There is no password field, no client secret, and no login form inside the extension.
- The last hour, self-enforced
- Google does not offer a time-limited Gmail permission, so the grant technically covers the whole mailbox. Every request MailKey makes carries an after: filter set to one hour ago — the limit is the extension’s own, kept in one small function, and it is stated plainly rather than implied.
- Sixty seconds
- A found code lives in session memory only, wiped when you use it, when the tab closes, or within a minute. Message bodies are parsed in memory and discarded — never written to disk.
- No servers, no analytics
- There is no backend. Requests go straight from your browser to Google. Nothing phones home, nothing is sold or shared, and there is no mechanism by which anyone else could read your mail.
- Never automatic
- MailKey does not fill without a click and never submits a form for you. The last decision is always yours.
One thing it is not: the domain shown next to a code is there so a mismatch is easy to notice. It is an aid to your own judgement, not phishing protection, and it is not described as protection anywhere in the product.
Not yet released. MailKey is being prepared for Chrome Web Store submission — it has not been reviewed, approved, or verified by Google, and there is nothing to install yet.