Store & insert XSS/SQLi/SSRF payloads, recon commands & pentest report templates into any field in one click.
Users
12
+10 in 30 days
Rating
5.0 / 5
+5.00 in 30 days
Ratings
3
+3 in 30 days
Store rank
#180K
#150K among extensions
Version
1.0.3
updated 3 Oct 2026
Users
monthly, 1 months
Latest, 17 Oct 2026:12 usersMove the mouse over the chart for any month
Ratings count
monthly, 1 months
Latest, 17 Oct 2026:3 ratingsMove the mouse over the chart for any month
The Chrome Web Store rounds user counts down to the leading digit, so the user line moves in steps. The ratings count is exact and is the better signal of real adoption.
About Recon Vault: Pentest Payloads & Recon Snippet Manager
Stop context-switching between notes apps, Gists, and browser tabs during penetration tests and bug bounty engagements. Recon Vault keeps your most-used XSS, SQLi, and SSRF payloads, recon one-liners, and vulnerability report templates one click away — right inside the page you're testing.
WHO IT'S FOR
Bug bounty hunters, penetration testers, red teamers, and application security engineers who are tired of re-typing the same payloads and recon commands during every assessment.
FEATURES
Instant One-Click Insert: Inject payloads directly into active form fields, target inputs, or report submission forms on any website.
Dynamic Variable Placeholders: Use tags like {{TARGET}} or {{ENDPOINT}} in your payloads. Recon Vault shows a quick fill-in prompt on insertion, saving manual formatting time.
46 Built-In Snippets, All Free: Comes ready on install with real-world security testing payloads, reconnaissance commands, and vulnerability report templates covering the categories bug bounty hunters use most often.
Keyboard-First Workflow: Press Cmd+Shift+K (Mac) or Ctrl+Shift+K (Windows) to instantly open the popup.
Folder Filtering & Search: Rapidly search titles and snippet bodies or filter by category with a single click.
Import & Export: Back up your entire snippet library to a JSON file, or restore/share it across machines in one click.
Private & Local-Only: Zero tracking, no analytics, no accounts, no background scripts. Snippets stay strictly in your local browser via chrome.storage.local, and nothing is ever sent to a server.
PERMISSIONS EXPLAINED
activeTab & scripting: used strictly to insert your selected snippet into the currently focused field when you click Insert. Never runs silently in the background.
storage: saves your snippets and folders locally on your machine. Nothing is sent anywhere.