Chrome extension

What the extension does

The MailTooth Chrome extension turns the Chrome side panel into a browser research workspace. It scans accessible webpage content for public email addresses, creates a deduplicated collection for each browser tab, verifies new discoveries with your connected account, and lets you save completed results without leaving the page.

Before you begin

Make sure you have all of the following:

• Google Chrome version 116 or later. The extension uses Chrome's side-panel platform and is not documented for other browsers.
• An active MailTooth account with credits. Discovery is free; automatic verification uses the connected account's credit balance.
• Permission to manage API keys in the selected account. This is what makes the Chrome extension tab appear under dashboard Settings.
• The official Chrome Web Store listing or an unpacked extension package supplied by MailTooth. Do not install a package from an untrusted third party.

Each browser profile or device should have its own extension token. Separate tokens make activity recognizable and let you disconnect one device without affecting another.

Install and open the extension

Install from the Chrome Web Store

1. Open the official MailTooth listing supplied to your account and select Add to Chrome.
2. Review Chrome's permission prompt, then select Add extension. The purpose of every permission is documented below.
3. Open Chrome's Extensions menu, find MailTooth, and select the pin if you want its toolbar button to remain visible.
4. Click the MailTooth toolbar button. Chrome opens the extension in the side panel next to your current page.

Install an approved unpacked package

Use this method only for a beta, test, or organization-managed build supplied by MailTooth. An unpacked extension does not update automatically.

1. Extract the supplied archive to a permanent local folder. The selected folder must contain manifest.json directly; do not select the archive itself or an extra parent folder.
2. Open chrome://extensions in Chrome and enable Developer mode.
3. Select Load unpacked and choose the extracted extension folder.
4. Confirm that MailTooth — Email Finder appears and is enabled, then pin and open it from Chrome's Extensions menu.

Connect your account

The extension uses a dedicated scoped token. It does not accept your password or a regular developer API key.

1. Open Dashboard → Settings → Chrome extension. If this tab is not visible, ask an account owner or administrator with API-key management permission for help.
2. Select Create token. Enter a recognizable device name, such as Chrome on Priya's work laptop. Names can be up to 100 characters.
3. Copy the complete secret beginning with mailtooth_ext_. It is displayed only once. If you close the dialog before copying it, revoke that token and create another.
4. Open the MailTooth side panel and paste the secret into Extension access token.
5. In MailTooth API URL, enter the API origin only:
   https://api.mailtooth.com
   Do not append /v1, /extension, or a trailing slash. Organization-managed staging environments should use the API origin provided by their administrator.
6. Select Connect account. A successful connection validates the token and loads the account identity and saved lists.

Discover email addresses while browsing

Once installed, the extension scans every accessible frame after a webpage becomes idle. It rescans when page content, attributes, form values, slots, browser history, hashes, or URLs change. It also rescans when you switch back to a browser tab or select the manual refresh action.

1. Open a normal http or https webpage relevant to your research.
2. Open the MailTooth side panel. The toolbar badge shows the number of unique addresses collected for that Chrome tab.
3. In Browser tabs, choose any collected tab. TheCurrent badge identifies Chrome's active tab.
4. Review the page card. Collected is the number of unique addresses, Valid is the completed valid count, and Pending is the number still queued.
5. If content appeared late or you want to force another scan, selectRescan current tab. The action is available only for Chrome's active tab.

What is inspected

Candidates are normalized to lowercase and deduplicated. Before an address is published to the side panel, the extension applies conservative mailbox syntax, URL-context, domain-label, and ICANN public-suffix validation. This removes many code fragments and URL credentials that only resemble email addresses.

What is not inspected

• Pixels inside images, screenshots, canvas elements, video, or other content that would require optical character recognition.
• Closed shadow roots, blocked cross-origin stylesheet rules, and content Chrome does not expose to extensions.
• Chrome internal pages, the Chrome Web Store, protected browser UI, and other schemes where Chrome blocks content scripts.
• Content behind access controls you have not legitimately opened. The extension does not bypass authentication, paywalls, CAPTCHAs, or bot protections.

How tab collections behave

A collection belongs to a Chrome tab, not only to its current URL. It grows cumulatively as you refresh or navigate that same tab, while each address retains limited source-page history. This makes multi-page research durable, but it also means an address from a previous page can remain in the tab's collection.

Closing a Chrome tab removes its collection. Refreshing, navigating within the tab, or suspension of Chrome's extension service worker does not clear it.

Automatic verification and credits

Discovery and verification are separate. Page scanning happens locally without credits. When the connected side panel is open, each new uncached address in the loaded collection enters a deduplicated first-in, first-out queue. Exactly one address is verified at a time to keep processing predictable.

Queue and cache behavior

• An address is added only once to the current in-memory queue, even if the page exposes it in several locations or frames.
• Completed results are cached in Chrome local storage for 24 hours, keyed by verification mode and normalized email address.
• Revisiting an address within 24 hours reuses the result only when the selected mode is the same, avoiding an unnecessary repeat charge.
• Changing from Quick to Standard or Deepcheck loads that mode's own cache and queues any address without a fresh result for that mode.
• A failed request is shown on its row and can be retried. Unknown verification outcomes are free; authentication, network, and insufficient-credit errors do not create a usable result.

Review, filter, select, and delete results

Every row shows the normalized address and its current state. Pending rows show a loader, failed rows show a retry action, and completed rows show a status or score. When mailbox evidence exists, the row also summarizes mailbox status and risk.

Filters

• All shows every discovery, including pending, failed, invalid, valid, and unknown rows.
• Valid shows completed results withaddressStatus: valid.
• Unknown shows completed results withaddressStatus: unknown.
• There is no separate Invalid filter. Invalid results remain available under All.

Selection and deletion

Select a row with its checkbox or by clicking the row. Select all applies to the complete tab collection, not only the currently filtered rows. Delete removes selected discoveries; the trash action in the page card clears the complete collection for that tab.

Save lists and download CSV files

A selected address becomes saveable after it has any completed verification result. This can include valid, invalid, or unknown outcomes, allowing your team to retain evidence for review instead of silently discarding it. The Save button displays only the number of verified selected rows.

Save from Discover

1. Select the completed results you want to keep.
2. Select Save. Choose an existing list, or enter a name to create a new list from the current page.
3. Confirm Save. Each item includes its normalized address, address and mailbox status, risk, score when available, verification mode, complete verification result, first retained source URL, and verification time.

An email address is unique within a list. Saving the same normalized address to that list again updates its result, source, and verified time instead of creating a duplicate row. A single save operation can contain up to 100 selected items.

Review and export from the side panel

1. Open Saved. Lists are ordered by their most recent update and show total and valid counts.
2. Open a list to review each saved email, mailbox status, and status or score.
3. Select the download action on a list card. Chrome opens its normal Save dialog for a CSV whose filename is derived from the list name.

You can also open Saved email lists in the dashboard to create and delete lists, review synced results, and download a CSV. The dashboard export additionally includes the verification mode.

Change preferences or disconnect

Automatic verification mode

Open the side-panel settings action, choose Quick, Standard, or Deepcheck, then select Save preferences. The new mode applies to subsequent work and loads its own 24-hour cache. Changing the dropdown without saving does not finish the preference change.

API URL

Hosted customers should keep https://api.mailtooth.com. Change this only when an organization administrator gives you a different environment origin. An invalid origin prevents connection, verification, and list synchronization.

Disconnect this device

Disconnect removes the locally stored token and verification cache, clears the connected session in the side panel, and returns it to the connection screen. It does not revoke the server-side token, remove tab discoveries, or delete saved lists. Revoke the token in dashboard settings as well if the device should no longer be authorized.

Revoke a device token

1. Open Settings → Chrome extension.
2. Find the device by its name, token prefix, and last-used time, then select Revoke and confirm.
3. Future extension API requests with that token fail immediately. The record remains visible as revoked and saved lists are retained.

Chrome permissions, privacy, and security

Chrome shows a broad webpage-access warning because the same scanner must work on the sites you choose to research. The extension does not need this access to bypass site controls; it needs it to inspect the accessible DOM on arbitrary webpages and frames.

What stays in Chrome

• The raw extension token, API origin, selected verification mode, and 24-hour result cache are stored in extension-local Chrome storage for that browser profile.
• Cumulative tab discovery state is stored in the extension's local IndexedDB database so it can survive page refreshes, navigation, and service-worker suspension.
• CSV content is assembled locally and sent to Chrome's download manager only when you request a download.

What is sent to MailTooth

• The token is sent as a Bearer credential only to the configured API origin for connection, verification, and list requests.
• Discovered addresses are sent individually for automatic verification when their queue item runs. The extension does not upload the complete page DOM as part of verification.
• When you save results, the selected verification data and retained source URL are stored in the connected account's email list.

Responsible use

Only collect and use contact data when you have a lawful purpose and permission to do so. Follow applicable privacy, anti-spam, and data protection rules, the website's terms, and your organization's retention and outreach policies. A technically discoverable address is not automatically consent to contact its owner.

Persistence and operational limits

Local state is deliberately bounded to keep long research sessions responsive. At a boundary, new addresses may be ignored or the oldest source metadata may roll off, depending on the resource, while the retained collection remains usable.

• Collections survive a page refresh, same-tab navigation, and extension service-worker suspension.
• Closing a browser tab deletes that tab's discovery collection. Saved server-side lists and the verification cache are separate and are not deleted with the tab.
• Clear or Delete suppresses those addresses for the remaining life of the open tab so automatic rescans do not restore them.
• Discovery order is based on first-seen time. The browser-tabs index is ordered by most recently scanned tab.

Troubleshooting

Start with the matching symptom below. Error messages from the API also appear in a dismissible red alert at the top of the side panel.

Frequently asked questions