Clock + widgets
Analog + digital clock, live weather with 3-hour forecast in °C or °F, AD/BS calendar with holidays and day details, reminders, quick notes, a daily focus prompt, focus pill and status bar.
Free Chrome new-tab extension · v1.5.0
Aura Tab
The iOS-style 3D glass new tab for Chrome.
Clock, weather, AD/BS calendar, reminders, notes, 150+ apps, 14 themes, toolbox, games and AI - plus adaptive typing, encrypted file transfers and a local-first Cowork Zone, wrapped in liquid glassmorphism.
Chrome Web Store v1.5.0 is public. The v1.5.1 video-playback and responsive-UI repair has been submitted for Google review, with public release after approval. It is not live yet.
- No account or sign-up
- No analytics, ads or tracking
- Local-first storage. Optional online features use third-party services
14theme families
150+curated apps
42theme modes
6offline games + chess
0accounts or trackers
Everything on one glass page
A local-first start page with no sign-up. The features below are in the current v1.5.0 release. The v1.5.1 repairs are awaiting review.
150+ app library
Curated shortcuts across AI, Google, Email, Dev, Hack, Microsoft, Design, Social, Music, Video, Shopping, Productivity and News - with folders, drag reorder, search and a macOS-style dock. Give any shortcut its own icon: automatic, letter, symbol, emoji or the site's favicon, in squircle, circle or square tiles.
14 glass themes
Mono, Glass 3D, Tactile, Liquid, Neu, Chrome, Parallax, Retro, Generative, Game, Aurora, Neon, Sunset and Holo - each in Light, Color and Dark modes, plus animated live wallpapers, glass blur and saturation controls, custom accents and wallpaper uploads.
Toolbox gadgets
Focus timer, calculator, a world clock with your own cities and a countdown to any date. Ask AI answers questions with your own OpenRouter key (free models, key is stored locally and sent only to OpenRouter).
Playable arcade
Five offline games plus full chess vs 5-level bot, local 2-player, and online play, chat, file sharing and calls over encrypted WebRTC. Version 1.5.0 uses 8-character invites with host approval and signed device identities. Both people must update and create a fresh invite; first contact is trust-on-first-use, not proof of human identity.
Typing Zone
Adaptive lessons focus on weaker keys and unlock more letters. Words, quotes, code, symbols and custom text; timed tests, per-key speed and accuracy, keyboard heatmap, daily goal and local history. Inspired by progressive typing practice, with an original implementation.
Drop Zone
Drag files or folders into an encrypted WebRTC room. Choose recipients, accept or decline files, cancel transfers and see speed, progress and ETA. Desktop Chrome can stream to a selected folder; memory fallback has a shared 256 MiB budget. Both tabs must stay open. Speed depends on devices, networks and whether a relay is needed, not a full-speed guarantee.
Cowork Zone
Up to eight people share a room with presence, chat, reactions, a task board, concurrent notes, whiteboard, focus timer, links and files. Every device keeps its own copy. There is no central backup or automatic proof of human identity: approve members carefully, compare device fingerprints over a trusted channel, protect the invite and trust every member. Deleting your copy does not delete theirs.
Zones release notes: tested in an unpacked Chrome extension, including public signaling and WebRTC between tabs. Independent cross-network devices and TURN fallback reliability are not yet verified. The disk-stream path was checked with browser filesystem handles, not a manually approved OS folder dialog. Browser permissions and available disk space still apply.
Included in v1.5.0
These features are available in the public store version. The v1.5.1 repair update fixes video playback and responsive layout issues, but remains pending Google review:
- Live video backgrounds - use a Chrome-playable video as your wallpaper: pick from a built-in gallery of Wikimedia Commons videos with the author and license shown on each (one tap downloads it straight to your device), upload a file or paste a direct mp4/webm link. It downloads only when you pick it, then stays saved on this device, with playback-speed control and reduced-motion respect. Separate gallery buttons open motionbgs.com pages where you can download a video yourself; that site blocks automatic fetching and its licenses are between you and the site.
- Files tools - on-device image compress and convert, plus a download helper that fetches direct file links. Inspired by file-reducer and converter sites, running entirely in your browser.
- Typing, Drop and Cowork as their own Zones - each has its own button and its own on/off toggle, so you can enable only what you use.
- Shorter 8-character invites with host approval - invites use 8 unambiguous letters and digits that are easy to read out. The invite only finds the session; it is not the encryption key. Every join shows the host or room creator the requester's name and waits for Accept or Decline before anything connects, and fresh encryption keys are still negotiated behind the scenes for each session. In Connect and chess, a 6-digit verification code compared over a call or in person helps spot anyone sitting between you, and every device also carries a long-term identity key: handshake frames are signed with it, paired devices are remembered, you can mark a device verified after the codes match, and a name appearing on a different device raises a warning. Drop and Cowork rooms carry the same signed device identity: join prompts show whether the knocker's device is new, seen before or a verified contact, and member lists show each person's device fingerprint - comparing it out of band plays the role of the code comparison there.
- Optional profile - set a display name, emoji and color once; it stays on this device. Your name is shown to the host or room creator when you ask to join a session; once you are in, members see your name, and Drop/Cowork rooms also show your avatar and color. No account, nothing required.
- Online chess - host approval, connection and moves in both directions were verified between two separate browser profiles on one machine using public relays. Independent-network reliability is not proven.
Gallery
Click any shot to view it larger.
Install in a minute
1
Get the extension
Install from the Chrome Web Store, or load unpacked: open chrome://extensions, enable Developer mode, choose Load unpacked and select the extension folder.
2
Set your weather city (optional)
Weather guesses an approximate city from your time zone. Type your own city for an exact forecast - the extension never asks for your device's location.
3
Make it yours
Open a new tab, press S for settings: pick a theme, wallpaper and PIN. Everything saves instantly in your browser.
Permissions it asks for - and why
- storage - saves your settings, shortcuts, reminders and notes locally.
- Host access - only to the services its features use: weather data (Open-Meteo), optional wallpaper photos (Picsum), optional favicon icons (DuckDuckGo, with Google fallback), your optional AI provider (OpenRouter), and public relays that exchange encrypted connection signaling for peer-to-peer connect.
Questions
Is Aura Tab really free?
Yes - every feature is free, with no account and no premium tier. Optional AI answers use your own OpenRouter key on free models.
Where is my data stored?
Dashboard and typing data are local by default; some preferences can sync through your Chrome profile. Cowork content is copied to connected room members. Optional features contact third parties, and this website's AI sends questions through its server-side endpoint. See the Privacy policy for each path.
Does it work offline?
Yes. Clock, reminders, notes, apps, themes, games, chess-vs-bot and Typing work offline. Saved Cowork copies remain on your device. Live collaboration, transfers, weather, live photos and AI need an internet connection.
Are online features fully server-free?
No. Aura does not run a file-storage server, but public MQTT brokers exchange encrypted signaling. STUN helps find a direct connection and TURN may relay encrypted traffic. Providers and peers can see network metadata. In v1.5.0, an 8-character invite finds the session and seals its initial handshake. Host approval is required; fresh session keys are negotiated using ECDH. Device signatures and remembered fingerprints help recognize a device, not a person. Keep invites private and compare codes or fingerprints over a trusted channel.
Which Chrome versions are supported?
Chrome 111 and newer on desktop. Folder-to-disk saving depends on the File System Access API and browser approval. Recent Chrome is recommended for Zones.
How do I reset everything?
Settings → Data → Reset wipes local data and restores defaults. Export a backup first from the same panel.
Support
Found a bug, want a feature, or need help? Write to us - we reply from cwe-ios@jiteshprakash.com.np.
Prefer a project inbox?
Email usauratab@jiteshprakash.com.np · info@jiteshprakash.com.np · info@jiteshprakash.info.np
Privacy policy
Updated November 13, 2026. Covers public v1.5.0 and the v1.5.1 repair awaiting review.
The short version
- No accounts. The extension never asks you to sign up.
- No tracking. No analytics, no ads, no beacons, no fingerprinting.
- No data sale. Optional online features send the data needed to the services or peers you choose, as described below.
- Local storage by default. Settings, shortcuts, reminders and dashboard notes are stored in Chrome's storage on your device (preferences optionally sync through your own Chrome profile, which is governed by Google's Chrome Sync policies).
What is stored, and where
| Data | Where | Synced? |
|---|---|---|
| Appearance and layout preferences | chrome.storage.sync | Yes, via your Chrome profile |
| Shortcuts, folders, reminders, notes, wallpapers you upload | chrome.storage.local | No |
| OpenRouter API key and model choice | chrome.storage.local | Never synced |
| Weather forecast cache (30 minutes) | chrome.storage.local | No |
| Typing settings, per-key statistics, daily practice and history | localStorage | No |
| Cowork invites, room list, names, chat, tasks, notes, whiteboard, focus and links | localStorage on each participant device | Shared directly with connected room members |
| File-transfer payloads | Temporary memory or receiver-selected disk destination | Sent to selected peers, not stored by Aura |
| Optional profile (display name, avatar emoji, color) | chrome.storage.local | Never synced; shown to the host when you ask to join a session, and to people in sessions you join |
| Randomly generated device identity key and remembered peers (names, public keys, verification marks) | chrome.storage.local; localStorage fallback in previews | Never synced; the public key/fingerprint is shared during peer handshakes, never the private key |
| Video wallpapers you pick (link or upload) | IndexedDB on this device | No; the video file itself stays on your device |
| Images you compress/convert, links you download | Processed in memory; results save where you choose | Never sent anywhere by Aura |
Dashboard data can be exported/imported/reset through Settings > Data. Typing has its own history/settings controls. Cowork rooms can be removed from this device using Forget on the room list; this does not remove copies on other devices. Uninstalling removes extension-origin local data, but not downloaded files. Cowork invites and local copies are not encrypted at rest by Aura.
Permissions
- storage: required to save your preferences and content.
- Host access is limited to the optional services below; the extension talks to them only when you use the related feature.
Third-party services (optional features)
- Open-Meteo (weather): your approximate coordinates or a city you choose are sent to api.open-meteo.com / geocoding-api.open-meteo.com to fetch forecasts. No account or key.
- Picsum (live wallpaper): a random photo is fetched from picsum.photos only if you pick the "Live photo" wallpaper.
- Video wallpapers: selecting a built-in gallery entry fetches that video from upload.wikimedia.org (Wikimedia Commons). The author, license and source page are shown in Settings. A custom link contacts the site you choose; optional host access may be requested only for that origin. No video is downloaded before selection. A playable copy is cached in IndexedDB on this device. If a source permits playback but blocks download, Aura may stream it without saving a copy. Uploading your own video reads it locally and does not send it to a server. Clear saved videos removes the cached copies. MotionBGs buttons only open that external site for manual download; Aura does not automatically fetch its videos. Source sites may see IP addresses and request metadata. Video playback pauses for reduced motion or hidden tabs.
- DuckDuckGo and Google favicon services (shortcut icons): if you set a
shortcut's icon to "Favicon", that site's hostname (for example
example.com, never a full URL, path or query) is requested from icons.duckduckgo.com, with www.google.com/s2/favicons as a fallback when DuckDuckGo has no icon. This happens only for shortcuts you explicitly set to Favicon, only over HTTPS, and only for http/https sites. If both services fail or the address is not a website, the icon falls back to a local letter monogram. Nothing is cached on our side; the services may see the hostname and your IP address when the image loads. - OpenRouter (Ask AI): only if you paste your own API key, your messages go to openrouter.ai under your own account and their privacy policy. The key is stored locally and never synced.
- Public MQTT brokers (Connect, Drop, Cowork and online chess): connection signaling passes through EMQX, HiveMQ, Mosquitto or Eclipse public brokers. Invites are 8 letters/digits you can read to a friend; the invite derives only a PBKDF2-hashed topic identifier and the key sealing the initial handshake - content and session keys come from a fresh ephemeral ECDH exchange every session (see SECURITY.md). Brokers can see topic identifiers, IP addresses, timing and traffic volume. They never receive the invite, content keys, or an intentional plaintext copy of content. Public brokers are third parties and may log metadata, reject connections or become unavailable.
- STUN and TURN services (WebRTC features): Google/Cloudflare STUN helps discover reachable addresses. A public Metered OpenRelay TURN fallback may relay encrypted traffic when a direct connection fails. Thus online features are not fully server-free, and not every connection is direct. WebRTC encrypts data with DTLS and calls with its media encryption. These services and connected peers can see network-address information; TURN operators can see traffic metadata but not the intended encrypted contents.
- Other room participants: an invite holder can request to join; host approval is required. Approved members can read and edit shared Cowork content and receive files you send. Signed device keys and remembered peer fingerprints help recognize a device, not a human identity. First contact is trust-on-first-use. Names/avatars alone are not verified identities; compare verification codes or fingerprints over another trusted channel. Invite holders may save or forward content. Keep invites secret, verify recipients using another trusted channel and create a fresh room if an invite leaks. A room lock is not identity verification or remote deletion. Closing a tab stops its live connection, not other participants' local copies.
Typing and file safety
Typing input/statistics are processed locally and are not sent by the Typing Zone. Do not paste sensitive text into a shared Cowork note or chat unless all participants may receive it. Incoming text is rendered as text, links are restricted to HTTP/HTTPS, and files require acceptance unless you enable room auto-accept. File names/relative paths are sanitized; files are not automatically opened or executed. Downloaded files can still contain harmful content. Transfer limits and browser restrictions apply; no unlimited-speed or unlimited-size guarantee is made.
Protocol compatibility
Version 1.5 replaces 26-character invites with 8-character invites backed by a new ECDH handshake. Both ends must update and create new invites; there is no insecure legacy fallback. These safeguards reduce unintended broker-subscriber access; they do not provide verified human identity or protection from an invited malicious member - compare the 6-digit verification code shown in Connect/chess to rule out an interloper.
Changes
Any change to this policy will ship with an extension update and be noted in the changelog.
Contact
Jitesh Prakash Chaudhary - https://auratab.jiteshprakash.com.np
This website and its optional AI
This website is hosted on Vercel. Hosting providers process network metadata needed to serve requests. The website assistant is separate from the extension's Ask AI: its questions and recent conversation turns go to a same-origin server endpoint and, when configured, Gemini, Groq or OpenRouter under their policies. API keys stay in server environment variables, not browser code. If a provider is unavailable or rate-limited, the assistant falls back to local product information. Do not send secrets or sensitive personal data. No analytics or advertising trackers are added by this site. The contact form opens your own email app and does not send automatically.