From MV2 to MV3: What to Expect From Dashlane’s MV3 Web Extension
You might have heard that we're approaching one of the most impactful architectural changes in the world of web extensions. Web browser makers, including Google, are introducing Manifest Version 3 (MV3) to ensure that the extension ecosystem remains secure and scalable and has the potential to extend beyond desktop environments. The 3 pillars of MV3 are privacy, security, and performance—and these align perfectly with Dashlane’s mission to provide a security-first password manager. In fact, we’re already preparing to transition from MV2 to MV3.
Learn more about how we approach security in our security principles & architecture white paper.
While it sounds like a simple version number change, the underlying differences between MV2 and MV3 are radical. The way browser extensions function is changing, moving away from one permanent background page to ephemeral “service workers.” To prepare for this fundamental shift, we’ve been working with Google and the extension maker community in the WebExtensions Community Group (WECG) to ensure that the Manifest V3 specification allows us to continue providing the secure, efficient product our users expect from us.
Transparency is deep within our DNA (Transparency and Trust is one of our values). We try to practice it every day, from making our mobile apps' source code publicly available to sharing the lessons we learned from preparing our new extension architecture. In this spirit, we’re providing more insights into the MV3 work we’ve done—and what's next.
How we’re testing the MV3 version of the Dashlane Chrome extension
The Dashlane Chrome extension has been one of our key products since we moved toward a web-first experience. The extension is responsible for managing access to the vault that securely stores all users’ data, recognizing forms to autofill, logging users in automatically, managing login sharing, and more. In addition, it provides tools that IT admins use to help employees at their organization. The architectural change Google announced earlier will be incompatible with MV2, and Google will no longer accept updates to MV2 extensions starting sometime in 2024.
Since late 2021, we’ve been working on our MV3 web extension. From the beginning, the main risk for us was the impact on the user experience. We weren’t sure what would happen if an ephemeral "service worker" stopped while someone was using Dashlane. We needed to maintain our product’s security and fluid flows at all times. Thus, we planned to reduce this risk as much and as early as possible.
First, we prioritized creating a testable MV3 version of our extension, called "Alpha," internally. Our product and engineering teams extensively tested this early-stage extension to assess the UX impact in the most challenging situations. (For example, what happens if there's an interruption during synchronization or when a user is changing their Master Password? How fast can we autofill a form if the service worker isn’t running yet?)
This helped us identify the UX aspects that would be impacted by MV3 and prioritize the flows and issues to fix first, with multiple internal milestones. This exercise also allowed us to define the performance metrics we wanted to monitor to compare our UX between MV2 and MV3 to ensure that there was no degradation in user experience for our customers. Putting the user experience at the center of our project strategy enabled us to prioritize more efficiently. The short feedback loops with frequent internal releases and "dogfooding" our own product helped us learn faster and adapt as we went.
We also provide constant feedback to Google and participate in the WECG meetings and group discussions. Thanks to this dialogue, Google adapted some of their plans for MV3, which helped fix some of our early issues.
Ready for what MV3 has in store
We're in great shape with our MV3 web extension now: Since late 2022, this is the product version we Dashlaners use as our day-to-day password manager. We're very happy with the results, as issues were much less frequent than we initially thought. This gave us confidence in February to ask some of our beta users and IT admins to help evaluate our MV3 extension to ensure their needs are unaffected by this architectural change. (We also have a beta program to join if you'd like to get early previews of our web extension!) We took these steps to prepare for a smooth and invisible transition for our users, and we’re confident that when we switch our public Chrome extension to MV3, that will be the case.
The main differences between an MV2 and MV3 extension are almost exclusively architectural and aren’t visible to the end user. However, this architectural change of moving away from background pages to service workers ensures that the web extension ecosystem remains a solid and flourishing platform. This was also our ambitious goal during these developments. We didn’t want to simply achieve MV3 compatibility in itself but to create a modern foundation to build upon—all while ensuring no visible changes for our users.
We are ready to gradually upgrade our Chrome web extension users sometime next year to the new version to ensure we comply with Google's revised MV2 sunset timeline. This upgrade will be automatic and invisible to users. Google is at the forefront of enforcing MV3 compatibility, but the architecture we've developed will allow us to quickly adapt to this new environment when other browser makers plan the switch from MV2 as well. We're closely monitoring the area and participating in discussions within the web extension community to ensure we can move promptly when needed.
This is the second post in our MV3 series, and we’re planning to publish more as we complete the transition. If you want to learn more about Dashlane tech, even beyond MV3, check the Engineering section of our blog.
Sign up to receive news and updates about Dashlane
