A browser extension that checks your text before it reaches ChatGPT, Claude, or DeepL — and blocks the part that shouldn't leave your machine.
Lostop doesn't change how you type — it just stands between your input field and the network.
Lostop watches the input field on the page — not your screen, not your clipboard, just what you actually type into the chat.
The moment you hit send, the text is checked against known leak patterns right on your machine — not a single character leaves for the check itself.
Clean, and the message goes through as usual. A secret is found, it's highlighted right in the field, and the request is stopped.
From cloud credentials to payment keys — detected locally, with card numbers checksum-validated to keep false positives down.
An optional local dashboard reads the same local database Lostop writes to — filterable by day, week, or month.
Built with Streamlit, running on the same machine as the server — no account, no cloud sync, no data leaving your device.
start-dashboard.bat) — no terminal requiredThe extension is one click via the Chrome Web Store. The local server takes one more step.
Prebuilt binary — no Python, no terminal.
Run the Python source directly.
At log on trigger — then it's a true "set it once and forget it" setup.Once you paste something into a GenAI chat and hit send, it's gone — no service will delete it from its logs on request. Lostop catches API keys, credentials, and other secrets before that happens, so a mistake doesn't turn into a real leak.
Browsers don't let a web page (or even an extension) run detection logic that touches your files or a database directly — for good security reasons. The local server is a small companion program that does the actual checking, entirely on your own machine, and talks to the extension over localhost only.
18 signature types: cloud and source-control credentials, AI provider API keys, private encryption keys, database connection strings, payment keys, team-tool webhooks and tokens, JWTs, and checksum-validated card numbers. See the full catalog above or the source in backend/main.py.
The server only listens on localhost — it isn't reachable from the internet, and the project doesn't operate any cloud backend to send data to even if it wanted to. The code is open source, so you (or anyone) can read exactly what it does — see the repository and the full Privacy Policy.