Creating an alias from the dashboard means leaving the page you were on. The extension removes that step: a button appears next to the email field, one click creates the address, fills it in and records which site it was for.

Most people who install it stop using the dashboard for creation entirely.

Pairing

From Connect extension in your account. Pairing is once per browser, and it issues a token limited to creating aliases.

That token cannot read your recipients, cannot change your account, cannot sign in to the web app, and does not carry your forwarding address. A compromised browser costs you the ability to create aliases, which is the smallest useful thing it could cost.

What it records

The site an alias was created on, so your dashboard can group and label them and show the site icon. Aliases created this way are flagged in the list, so you can tell them apart from the ones you made by hand.

Revoking

From the same page. Revoking is immediate, and the extension simply stops creating addresses.

What it does not do

Read pages, read your mail, or send anything anywhere except the request that creates an alias.