CleanTab

Lock it down.

A blocker you can switch off in two clicks isn't a blocker. Here is every layer of friction CleanTab supports, from a passphrase someone else holds to an admin policy that makes the extension genuinely unremovable.

One rule shapes all of this

Friction on turning CleanTab off should be as high as you can make it. Friction on getting past one wrong block should stay near zero.

Those are different doors and they should not share a lock. Detection misfires — on health writing, on art, on news reporting. If a misfire becomes unreachable content, the tool stops being trustworthy and gets uninstalled wholesale. So every layer below governs the off switch, and none of them touch “let me through once.”

Without an admin account

For adults binding their own future selves. All of it is in the Guard tab, and none of it needs a server, an account or an email address.

Accountability partner

Hand your laptop to someone you trust. They type a passphrase and keep it. CleanTab stores a one-way hash of it and nothing else — you need them present to turn protection off.

This is the mechanism paid competitors sell as a subscription. The social cost is what makes it work, not the cryptography — so it needs no backend, and no contact details ever leave your machine.

Escalating cooldown

The first disable costs you an hour. The second within the same week costs two, then four, then eight, capped at a day.

A flat wait treats your first slip and your fifth identically. Repeat impulse is the actual failure mode, so the price rises with it — and decays again after a week.

Lock window

Nominate the hours when you know your judgement is worst. During them the off switch simply does not exist — and you can't edit the window from inside it.

Chosen while calm, enforced while not. Most people pick late night.

Typed passphrase, twice

Before and after the cooldown, drawn from a pool in the source. Paste and drop are blocked, so it has to be typed.

Honest about what this is: friction, not security. The pool is readable in the repo by design.

What none of this can do

A browser extension protects one browser. It does not cover a second browser, a phone, another device on the same wifi, or a portable browser on a USB stick. Anyone with developer tools open defeats any client-side lock, including every layer above.

The realistic setup is three layers, and we're only the third:

1.DNS filtering at the router or device — NextDNS, or Cloudflare for Families on 1.1.1.3. Catches every browser and every app on the network.
2.OS-level controls — Screen Time on macOS and iOS, Family Link on Android, Family Safety on Windows.
3.CleanTab — the in-page layer neither of those can do. DNS can't see inside a search results page or a social feed. We can.

Set up the first two even if you never install us. A tool that tells you it is total coverage is lying, and you find out at the worst possible moment.

With an admin account

Chrome's enterprise policy can install CleanTab so it cannot be removed or disabled from the browser interface at all, and can lock its settings so they can't be changed from the popup either. This is the only layer that is genuinely unremovable rather than merely inconvenient.

Use this on a device you own or administer, with the knowledge of the person using it. Installing an unremovable monitor on another adult's browser without telling them is coercive control, not accountability, and we won't help with it. For a parent and a minor child, or for your own machine, it's exactly the right tool.

Before anything else: they must not be an administrator

Every layer below is enforced by an OS policy, and every OS policy can be removed by an administrator in about a minute. If the person you are setting this up for signs into an admin account — which is the default on a family laptop with one shared account — none of this holds.

macOS: System Settings → Users & Groups → their account must be Standard, not Administrator.
Windows: Settings → Accounts → their account type must be Standard User.
Both: your own admin account needs a password they do not know, and they should not watch you type it.

1 · Platform

2 · Extension ID

Find it on the CleanTab listing in the Chrome Web Store, or at chrome://extensions with Developer mode on. Left blank, the file below uses a placeholder you'll need to replace.

3 · Close the bypasses

4 · cleantab-policy.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist]
"1"="abcdefghijklmnopabcdefghijklmnop;https://clients2.google.com/service/update2/crx"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome]
"IncognitoModeAvailability"=dword:00000001
"BrowserGuestModeEnabled"=dword:00000000
"BrowserAddPersonEnabled"=dword:00000000

5 · Install it

1.Save the file, then right-click it and choose Merge. You'll need an administrator account.
2.Restart Chrome completely — quit it, don't just close the window.
3.Open chrome://policy and press Reload policies to confirm it took.

Locking the settings too

Force-installing stops removal, but the user can still turn the sensitivity down. CleanTab reads Chrome's managed storage, so an administrator can pin those values properly — they become read-only in the popup, with a note saying who set them.

Add any of these alongside the forcelist, under the 3rdparty/extensions/<your-extension-id>/policy key:

{
  "sensitivity": "strict",
  "enableDwellDetection": true,
  "allowDisable": false,
  "allowAppeals": false,
  "allowTrustSites": false,
  "lockedTrustedSites": ["school.example.edu"]
}

allowDisable: false removes the off switch entirely, and overrides a disable that was already running.

allowAppeals: false stops the user granting a site permanent trust from the pause screen. Deliberately, this does not disable “let me through once” — that's the one door that stays open, for the reason at the top of this page.

How you remove it later

Removal is the mirror of installation: you take the policy away, not the extension. While the forcelist is in place nobody can uninstall CleanTab from chrome://extensions — including you. That is the point, and it is also why this section exists.

1.Windows: delete the ExtensionInstallForcelist key under HKLM\SOFTWARE\Policies\Google\Chrome, along with any other values the generator added.
2.macOS: System Settings → General → Device Management → select the CleanTab profile → remove it.
3.Linux: sudo rm /etc/opt/chrome/policies/managed/cleantab.json
4.Restart Chrome completely and check chrome://policy. CleanTab is now an ordinary extension you can remove normally.

Reinstalling Chrome does not clear this. The policy lives in the OS, not in the browser, so a fresh Chrome picks it straight back up — which closes an obvious bypass, and is worth knowing when you are the one trying to undo it.

The bypasses a Chrome policy can't close

The generator closes the in-Chrome routes. These are outside it, and they are why the DNS and OS layers above are not optional:

Another browser. The policy covers Chrome. Firefox, Brave or Edge installed afterwards are untouched. A standard account blocks most installs on macOS; on Windows, per-user installs can still succeed.
A portable browser on a USB stick. Runs without installing anything.
A phone or tablet on the same wifi. Nothing about a browser extension reaches it.
The built-in reflective passphrase. Those eight phrases are in the public source. They are friction for an adult binding their own habits, not a parental control — set allowDisable: false by policy, or set a passphrase of your own during onboarding.