Capture a signed-in page
into Figma.

Why it works without your password.

LilLabr reads the tab you are looking at. Your session cookies stay in Chrome, no LilLabr server fetches the address, and the extension never asks for a password; password fields are masked in the capture. Whatever the page shows you after you signed in is what gets captured. The panel itself is Chrome’s side panel, not part of the page, so it is never in a capture.

Two details worth knowing. When the capture re-fetches an image or icon the page declared, including responsive image candidates the page did not paint, a same-origin fetch runs in the page and may carry that site’s existing cookies, just as the page’s own requests do; cross-origin fetches go through the extension’s relay without credentials. And the hosts that serve those resources can observe the requested address and your IP address, as they did when the page loaded.

Keep the capture on your computer.

1. Open the LilLabr panel with the toolbar icon, choose Settings at the bottom of the panel, and turn Save captures off before you capture. In a new installation you cannot reach Settings until the first capture is done: ticking I agree to the Privacy Policy and Terms on the first capture step turns Save captures on for that capture and later ones, so make your first capture a page you do not mind uploading, such as the welcome page, then turn the switch off before you capture a private page. An explicit Off choice stays Off across updates, and pairing the Figma plugin with a setup code while Off does not turn it back on.
2. Press Capture full page, Capture screen or Pick element as usual.
3. Paste into a Figma Design file, or press Download capture and open the file on the plugin’s Import a file tab. Neither route uploads the capture to LilLabr’s sync service.

What still leaves your machine on those routes: the paste goes to Figma, under Figma’s terms; the paste route may ask jsDelivr for Fontsource copies of Google Fonts so Figma can measure text; and your operating system’s clipboard history or sync may keep a copy of the payload. There is no blanket “nothing leaves your device” promise, and LilLabr’s documentation does not make one.

What is masked, and what is not.

• Masked: password fields; fields identified as card fields; populated text inputs, textareas and selects inside embedded frames, in both the editable scene and the direct paste.
• Not masked: visible text. A customer’s name in a table cell, an email address in a header or a balance on a card is content, and it is captured as a text layer. Ordinary form fields outside embedded frames show their values, and unmarked top-level card fields may be captured. Capture is not a complete redaction system.
• The thumbnail: since 1.0.6 the thumbnail uploaded with the archive, and the capture’s picture in the panel, are drawn from the capture itself rather than from a screenshot, so they show those fields masked too. The one screenshot left is the viewport preview that goes to an AI assistant with a capture unless the app asks for none; it shows whatever was on screen, including fields the capture masks. Chrome does not keep it. Through the local link it goes only to the app; through the connector link LilLabr’s service also holds it, encrypted, for 60 minutes after the request ends, and Delete now removes it.
• The address: the page address recorded in the capture loses its credentials, the whole query string and the fragment, so https://example.com/pricing?token=abc#plans is recorded as https://example.com/pricing; the picture the panel keeps and a capture report hold the origin and path only. A capture made for an AI assistant applies a different rule to link addresses, those stored in the file and those the assistant is told: they lose user names, passwords and query parameters named like secrets, a rule of thumb by name, so a secret under another name can remain in a link. In any capture an outbound link can still carry its query string, and a code rendered on the page is still text, so a clean address does not make an archive safe to share.

If the page shows real customer data, capture a test account, or crop to the component you need with Pick element.

Staging, VPN and localhost.

Plain http pages and local development servers work, because the extension runs on any ordinary http or https page in Chrome. A page behind a VPN works for the same reason. A local file:// page works once you enable Allow access to file URLs for the extension. Chrome’s own chrome:// pages and the Chrome Web Store cannot be captured.

If you connect an AI assistant through the local MCP server, it can also capture pages with your logins, but only on websites you approve one by one in a window of LilLabr’s own. That window says when a site is on your own computer or network, because an admin page on a private network is a different decision from a dev server. Captures made for the assistant are files on your computer: LilLabr never uploads them, even with Save captures on.

LilLabr 1.0.6 also offers a hosted connector link, made for apps that cannot reach your computer: Claude on the web, desktop and phone, and ChatGPT on the web on the plans that allow custom connectors. Codex and Claude Code can use it too, though both can also run the local link. It needs a Google sign-in, and a capture the app asks for passes through LilLabr’s cloud. That copy is encrypted with a key from the link but not end to end, so the developer could read it while it exists. Anyone who has the link can ask for captures, each website still needs your Allow in a window of LilLabr’s own, and websites on your own computer or network, such as localhost, are refused through that link. While Save captures is on, a capture the app asks for is also saved like one you make yourself. If you want nothing in the cloud, use the local link.

Before you share a capture.

• Review the pasted layers or the .labr file as you would a screenshot of the same page. Delete layers you do not want to pass on.
• Forget latest capture in Settings removes the cached copy from this Chrome, together with that capture’s picture. The panel keeps a picture of each of your 24 most recent captures for up to 7 days; removing the extension deletes them at once. Clear your clipboard history after capturing sensitive material.
• If Save captures was on, delete the synced page or flow from the paired plugin, or press Remove beside a page of the current flow on the panel’s Recent tab. Turning Save captures off or disconnecting does not delete copies that were already uploaded; synced captures also expire after seven days.
• If an AI app captured the page through the connector link, Delete now under Settings, AI connector removes every capture stored through it. It does not remove the copy that Save captures made if the switch was on at the time: delete that one in the plugin, or with Remove on the Recent tab, as above. Those captures also expire on their own, an hour after the app last reads them and a day after they were made at most.
• Capture only pages you are allowed to use, and treat other people’s data in them as their data.

The full privacy policy lists every request the extension makes and what each surface stores. Related: capturing app screens and what a .labr file contains.