Lock the sites that should wait.
One PIN locks every protected site. No data loads until you unlock it.
Built for real enforcement.
Most website blockers hide content after it loads. Bastion stops the request itself.
Network-first block
Locked sites are redirected before any data is fetched. The real page never starts loading.
One master PIN
A single 4-digit code protects every site. No per-site passwords to forget.
Brute-force lockout
Three wrong attempts trigger a 5-minute cooldown. Every tab on that domain locks again.
Instant re-lock
Press Alt+Shift+L or Option+L to re-lock the current tab without reloading manually.
Recovery phrase
A 6-word phrase is generated when you set your PIN. Use it to reset if you ever forget the code.
Anti-tamper overlay
A closed Shadow DOM overlay pauses media and re-injects itself if someone tries to remove it.
How it works.
Four steps between you and a locked-down browsing habit.
Install Bastion
Load the unpacked extension in Chrome developer mode.
Set your PIN
Choose a 4-digit master code and save the recovery phrase.
Add a site
Enter any domain and confirm your PIN. The tab reloads locked.
Unlock once
Enter your PIN on the challenge page. The site loads per tab.
Security is the whole point.
Bastion is designed for people who actually want to be stopped. The lock is not an overlay. It is a gate.
It will stop a normal user, a curious sibling, or a distracted version of yourself. A determined attacker with full machine access can still disable the extension, because that is true of any browser extension.
PBKDF2-hashed PIN
Your PIN is never stored plain. It is hashed with a random salt and 100,000 iterations.
Per-tab sessions
Unlocking one tab does not unlock another. Each browser tab proves itself independently.
Declarative network rules
The redirect happens through Chrome's declarativeNetRequest API, not a content script race.
No network, no leak
Because the request is blocked at the network layer, the real page data cannot be cached, scraped, or previewed.
Load it in Chrome.
Five minutes and you are protected.
Download the build
Grab the latest bastion.zip from the GitHub release.
Unzip the archive
Extract the folder somewhere you can find it.
Enable Developer mode
Open chrome://extensions and flip the switch in the top right.
Load unpacked
Click Load unpacked and select the extracted bastion folder.
Lock your first site
Open Bastion, set your PIN, add a domain, and try visiting it.