Velum Lite is on the Chrome Web Store, and the zip is gone
Until today, installing Velum Lite meant downloading a 151 MB zip from our site, unpacking it into a folder you had to promise never to move, turning on developer mode in Chrome, and clicking Load unpacked. Then dismissing a warning about developer mode extensions every few restarts.
We asked people who care about handling data carefully to do the one thing security teams tell them not to do.
Velum Lite is now on the Chrome Web Store. One click, and Chrome keeps it updated on its own.
We deleted the zip
The obvious move is to add the store link and leave the zip up for anyone who prefers it. We took it down instead, from the website and from our download host, and removed the script that publishes it.
A zip has no identity. Once a file is passed around, nothing in the browser checks who built it, and a copy with three lines changed installs exactly as smoothly as ours does. The only thing keeping that copy honest is that the person handing it to you has not touched it. That is not a security property, it is a hope.
A store listing does not fix everything, but it does fix that. The package is signed, updates arrive through a route we control, and the name on the listing is one we can be held to. So there is now exactly one place to get Velum Lite, and anything else offering it is not ours.
The tradeoff is real and worth naming: we gave a third party a switch. Google can pull the listing, and if it does, our users lose their update path. We would rather carry that risk than keep telling people to run unsigned code from a folder.
What is actually in the package
The 151 MB is almost entirely the detection model. It ships inside the extension, which is why the store package is large and why nothing downloads on first run. The first mask after install pauses for a moment while the model warms up, and then it is instant.
Everything after that happens in your browser. The extension makes no network requests at runtime, and you do not have to take our word for it:
- Right click inside the popup and choose Inspect.
- Switch to the Network tab and set Chrome to Offline.
- Mask something, then unmask it. The request count stays at zero.
It also asks for no site access when you install it. The extension declares no host permissions at all, and the ones it can request are optional: Claude, ChatGPT and Gemini, for the in page Mask button, plus your own machine on localhost if you pair it with the desktop app. Leave the button off and it never asks for any of them.
Free, with a line that has not moved
Masking text in the popup is free. No key, no account, no clock running in the background. Paste, mask, copy, and use the result in whatever chat you were already in.
A licence adds masking files you drop on the popup, and the in page button. Unmasking is never gated in either direction, so anything you have already masked can always be restored, licence or not.
If you already had the unpacked build
Remove it from chrome://extensions and install from the store. Two things to know.
Your licence key does not carry over. An unpacked copy and a store copy are different extensions as far as Chrome is concerned, with separate storage, so paste your key into the popup settings once more. It is the same key, and it still works in the desktop app too.
Your unmasking is unaffected, because the mapping between a placeholder and its real value lives in your browser session, not in the extension folder you are deleting.
On the review itself
It took three days from first submission to approval, which is quick for a new developer account shipping a 151 MB package.
Two of those days went to rejections, both for keyword spam, both earned. Our listing described what the extension detects by listing things out: file formats in one place, cloud and developer services in another. Read as prose it is a specification. Read by a policy reviewer it is a wall of brand names in a store description, which is exactly the pattern the rule exists to catch. We rewrote both passages to describe categories instead of naming vendors, and the third submission went through.
Getting it
Velum Lite on the Chrome Web Store
Works in Chrome, Edge and Brave. The desktop app for macOS is separate and still a direct download from us, because it is a signed and notarized app that Apple already checks.