Frequently asked questions

Web Reactions is a browser extension that adds an emoji-reaction button to many websites. You react with any emoji from the full Unicode set, and you see aggregate counts of how everyone else reacted to the same page, post, or item. The counts are public; the identities behind them are not.

Yes. Web Reactions is free to install, free to use, and there are no paid tiers. The project accepts donations to cover server costs, but every feature is available to every user.

Yes — the extension code is licensed under GPL-3.0. The source lives on GitHub. You can read the code, build it yourself, file issues, and send pull requests.

Store releases go through the stores' own review before they are published — the Chrome Web Store and Mozilla Add-ons both examine new submissions and updates. The extension's full source is public under GPL-3.0 on GitHub, so what it does is open to inspection rather than taken on faith.

If you'd rather not rely on a store build at all, you can build and install it from source and run a copy you compiled yourself.

A solo developer. There is no parent company, no investor, and no advertiser relationship. The project is funded by donations and operated to break even on infrastructure.

Native buttons give you one or a handful of choices and feed the host platform's algorithm. Web Reactions gives you the full emoji palette, shows counts that nobody can manipulate by paying for promotion, and works across every supported site with the same UI. You can keep the native button or hide it from the extension settings. For the broader idea behind the product, read The signal platforms hide.

Open any supported page. A small "React" button appears next to the site's existing action row. Click it, pick an emoji (or type a word to search), and you're done. The picker opens with your recently used emoji and a Popular row, so common choices are one tap away.

Near the top, the picker shows a Popular row so the emoji people reach for most are one tap away. It reflects a community trend: which emoji the whole Web Reactions community is using most. It counts everyone who has ever reacted, aggregated across all supported sites and refreshed daily, so the set and its order shift over time.

Yes — click the picker again and choose a different emoji. The previous one is removed from your record and the counters update accordingly. Only one reaction per item per account.

Click the same emoji you already picked, or use the picker's highlighted entry to toggle it off. Removing it decrements the aggregate count by one.

Right next to the original buttons on the page — a thumbs-up row on Facebook, the action row next to Star on GitHub, the rating area on Amazon, and so on. The extension's popup also keeps a personal History tab so you can revisit what you reacted to.

Yes. A reaction is attached to the page itself, not to a chat. Anyone who opens the same supported link with Web Reactions installed sees the same public reaction layer and count — it isn't locked inside a message thread or a screenshot.

No. Web Reactions is for public, addressable content only. The extension does not offer reactions on private pages such as private repositories, private projects, closed groups, private accounts, or other pages that an anonymous visitor cannot view.

On long feeds, Web Reactions does not add buttons to every post at once. It waits until a post is close to the part of the page you're looking at, then adds the button. As you scroll, more buttons appear along the way. This is expected and helps long pages stay fast.

Yes. The picker has a search bar that matches Unicode CLDR labels and tags. love, amour, and 愛 all find ❤️; fire finds 🔥; idea finds 💡. Search works in the same language your browser is set to.

Yes. You can move through choices with the keyboard, pick with Enter or Space, and close the picker with Esc. Screen readers are told when the picker opens and what is selected.

Open the extension popup → Settings → "Replace original buttons". When on, the site's native button is hidden in favour of the picker. The setting is global; you can flip it back any time. A reload of open tabs is needed for the change to take effect.

Yes. The popup has a per-site toggle for every supported site, plus a global "Enabled" switch. Disabling a site hides the picker there without uninstalling the extension.

It counts the Web Reactions buttons that appear on the current page as you open and scroll through it. The number only goes up while you stay on the page: it does not drop when posts scroll out of view, and it resets when you open another page. It is not how many reactions you have made, not an unread-notification count, and not the total number of reactions from everyone. On sites Web Reactions doesn't support, the toolbar icon is grey and shows no number.

So one person counts as one vote. Reading reactions is fully anonymous and requires no account; only submitting one needs a verified identity, which is what makes the counts meaningful instead of botted. The full reasoning is on Passwordless sign-in.

Social sign-in would tell the social provider every site you react on. Device IDs are trivial to mint by the thousand and would make counts as fake as the platforms we're trying to fix. Email is the one identifier almost everyone already has and that costs real effort to mass-produce.

No. Your email is sent over TLS, used once to deliver a verification code, and then discarded. The only long-lived value is an irreversible salted hash that becomes your account identifier. Even we cannot look up an account by email — only by hash.

Enter your email; we mail you a 6-digit one-time code; enter the code and you're signed in. No password to remember, no password to leak, and no password reset flow because there is no password. To sign in again, request a new code. When the session expires, the next reaction will reopen the sign-in tab.

No. After you sign in or sign out, open tabs update by themselves. The picker and counters refresh automatically, so you normally do not need to reload the page.

Check your spam folder first — transactional one-time codes are sometimes filtered. Delivery can take up to 10 minutes depending on your mail provider, so wait that long before requesting a new one. If nothing arrives after that, open the extension popup → Report tab and submit the issue with details about your email provider (Gmail, Outlook, ProtonMail, iCloud, a corporate server, etc.) so we can investigate the delivery path. Some corporate mail servers and a handful of mail providers block automated mail; if yours does, try a different address.

No. The extension and the server both reject known disposable-mail domains. Temporary inboxes would let a single person mint unlimited accounts, which is exactly the abuse the email check exists to prevent.

Open the extension popup → Account → Sign out. Your local session is cleared immediately; your past reactions and counters are untouched.

Popup → Account → Delete. Your user record is erased, every reaction you submitted is decremented from the aggregate counters, and your local session is cleared. Deletion is immediate and irreversible — there is no queue, no review, and no soft-delete.

On supported sites, the content script reads the page locally to find the posts or items that can take a reaction and the right spot for the button. That analysis stays in your browser. To show counts, the extension asks our server for the totals of the public items on screen — an anonymous read that needs no account and is not kept as a browsing record.

Submitting a reaction sends exactly what the vote needs: the item's public URL, the emoji you picked, and your session token. If the optional reaction-context setting is on, the submission also carries the coarse context described on the privacy page. Nothing is collected from pages you did not react on.

The reactions you submit, the public target you reacted to (e.g. a GitHub repo URL), a salted hash of your email as your account identifier, a signed session token, and a salted hash of your IP used only for rate-limiting. That's it. Full list on the privacy page.

No name, no persisted email, no raw IP, no browser fingerprint, no hardware identifiers, no analytics, no tracking cookies, no third-party marketing SDKs, no data from pages you didn't react on, and no password. Full list on the privacy page.

Three standard permissions: storage keeps your settings and your local reaction history in the browser; alarms lets the background worker wake briefly to send queued reactions and refresh cached data; activeTab lets the popup see which site you are on, for the per-site toggle and bug reports.

Site access is limited to the supported sites plus our own API — there is no "read all websites" permission. The exact list ships in the extension's manifest, which anyone can read in the source repository. For the full breakdown, including what each browser's install prompt shows, see Browser permissions.

No. We don't sell data, share it with advertisers, or hand it to data brokers. The subprocessors we rely on act as data processors under GDPR — they store or transmit on our behalf and cannot use the data for their own purposes.

The aggregate counts on each item are public. The individual mapping of "which account picked which emoji" is never exposed through the API and is held only long enough to prevent double-voting before it is deleted.

Only in your browser. The list of recent reactions shown in the extension popup is kept in your browser's local extension storage (the last 1000) and is never uploaded to our servers. It is cleared when you delete your account or uninstall the extension.

No. The API exposes aggregate counts and your own reaction (only to you, only when signed in). There is no "who reacted" endpoint and there will never be one.

The extension runs in private mode if you allow it in your browser's extension settings. Reads work as usual. Writes require a signed-in session, which lives in extension storage — most browsers keep extension storage scoped per profile, so you may need to sign in again from a private window depending on the browser.

Each account contributes at most one reaction per target. The displayed number is the sum across all such accounts. There is no weighting, no algorithm, and no "trending" boost — one person, one count.

No. Each account is allowed exactly one reaction per item; changing it replaces the previous one rather than adding a new vote. The server enforces this on submit.

The email-OTP requirement makes mass account creation expensive, and the disposable-domain check rules out the cheapest way to automate it. Rate limits and replay-protection nonces stop a single account from spamming. Nothing eliminates abuse entirely, but the bar is set high enough that the counts mean something.

Yes. Every reaction is appended to a public, append-only log, and periodic checkpoints of that log are cryptographically signed and anchored outside our servers (a public GitHub mirror, Bitcoin via OpenTimestamps, and independent third-party logs and archives — Sigstore Rekor and Software Heritage). Anyone can run the open-source verifier to recompute the totals straight from the log and confirm the signed history was never rewritten or deleted — that's the trust model: counts you can verify, not counts you're asked to take on trust. It protects against history being changed after the fact; it does not by itself prove every reaction is from a unique person. A map of the underlying data (the log, checkpoints, anchors, and the derived counters) is on the transparency log page.

Not quietly. Reversing a vote appends a permanent, signed public entry with a stated reason — it can never be hidden or edited later. Math alone can't prove the stated reason is truthful, but abuse would be loud: reversals cover an account's whole history, your extension keeps your own history on your device as evidence, and anyone can watch the public revocation feed on the status page. The full picture is in What this proves — and what it doesn't.

Web Reactions remembers reaction numbers for about one minute so pages feel quick. If you open a post and see 5, close it, then open the same post 30 seconds later, you may still see 5 even if other people have already pushed it to 7. After about a minute, opening or refreshing the post shows the newer numbers. Your own reaction still appears right away for you.

Most often this is a stale cache — wait a few seconds or reload. If you signed out between viewing and reacting, the click opens the sign-in tab instead of voting; sign in and click again. Persistent failures are worth reporting from the extension's Report tab.

Yes. If you react in one tab, other open tabs with the same item update automatically. You do not have to refresh another tab just to see your own recent change.

See the full, current list under Supported websites on the home page. The list grows over time through normal extension updates, so each new site adapter is reviewed and shipped with the extension.

Yes. Open a site request issue with a few example URLs and screenshots of where the picker should sit. Site requests are tracked as GitHub Issues so they can be searched, deduplicated, prioritized, and closed when the adapter ships. Sites with stable, public, addressable item URLs are the easiest to add.

Sites we support change their HTML constantly — sometimes overnight, without warning. The extension finds the right place to inject the picker using a small set of CSS selectors per site, and those selectors stop matching the moment a site ships a layout change. Historically, that means an extension update, a store review wait, and a few days of broken-looking pages for users.

Web Reactions keeps site-specific DOM adapters inside the reviewed extension package. That makes the shipped behavior inspectable and predictable: if a supported site redesigns a page, we update the adapter and ship a normal extension release.

The public counts and transparency log stay independent from those DOM adapters. A broken adapter can stop the picker from mounting on one site, but it does not let the service rewrite counts or change the extension's executable behavior outside a store-reviewed update.

Any Chromium-based desktop browser (Chrome, Brave, Vivaldi, Opera, Arc, Edge, …) via the Chrome Web Store, and Firefox 115+ via AMO. See Install for the full matrix including mobile and forks.

On Android, yes — through Firefox for Android (recommended), or a Chromium browser that supports extensions such as Microsoft Edge, Quetta or Lemur Browser. On iOS, a Safari Web Extension is planned but not yet shipped. Until then, mobile Safari is unsupported.

Your reactions do. Your account lives on the server, so signing in on a second browser shows your reaction on each item and the same public counts. Your history list (the log in the History tab) is kept on each device, so to carry it to another browser, export it there and import it. Local settings (which sites are enabled, "replace native", etc.) are per-install today.

Check the popup: the master "Enabled" switch should be on, and the per-site toggle for the site you're on should also be on. If the site recently changed its layout, the adapter may need updating — use the Report tab to let us know.

Stay on the page where the button is missing and open the extension popup → Report tab from there. Submitting the report directly from the broken page attaches the exact URL so we can reproduce the layout and ship an adapter fix. If the site is supported but the picker is hidden, double-check that both the global "Enabled" switch and the per-site toggle are on, then reload the tab before reporting.

That's a per-email lockout after several incorrect codes in a row. Wait an hour and request a fresh code. It exists to make brute-forcing other people's accounts impractical.

The OTP request endpoint is rate-limited per email and per IP to stop someone from mailbombing strangers with codes. Wait a few minutes and try once more.

If the browser has been idle, the extension may need a moment to wake up before sending your reaction. If a reaction cannot be sent immediately, the extension keeps it locally and tries again in the background.

They go to different places. For a bug on a specific site, such as a picker that won't appear or a broken layout, use the extension popup's Report tab, opened on the affected page so it captures that page's URL. To suggest a new site, open a site request issue. For a feature idea that is not site support, open a feature request issue. If the popup cannot open, use the bug report issue. The Report tab isn't meant for site suggestions.

The content script renders only when the picker comes into view and keeps its UI isolated from the page so each side avoids breaking the other's styles. Reads are batched and cached for a minute. On normal pages the cost is unmeasurable.

If you inspect the page, the Web Reactions button may appear inside its own protected area. That is normal and helps the site and the extension avoid breaking each other's styles.

You can view and submit reactions on every supported site without ever signing in to that site itself. A single Web Reactions account, verified once by email, works across many popular sites. No host-platform login, no per-site account, and no caps on how often you can react.

Donations. There is no advertising, no paid tier, no data monetisation, and no investor with a return to chase. The donate page lists current ways to chip in.

GPL-3.0-or-later for the extension source code. You can self-host, fork, study, and redistribute under the same terms.

See the compare page and the individual head-to-heads against similar browser extensions. Switching from one of them? See the switching guides.

Open a question issue on GitHub. If it is a privacy or legal question, use the privacy/legal issue instead. We update this page as new questions come up.