Stringers
Chrome extension · written 11-6
FBSTOCKER [ Key Hub ] — Passkey & 2FA Manager · FBSTOCKER LABS

A plugin from an account seller on the side: Meta pushes passkeys, a Russian shop takes 6,000 users with a free tool

What it is A free Chrome extension that generates and stores passkeys and 2FA codes inside the browser, and can export them to a spreadsheet or bulk-import them, so ad accounts with passkeys can still be transferred.

Why it took off In August 2026 Meta required advertisers to set up passkeys, breaking the account-farming trade's "one row of data per account" handover. It launched the same week, and every account the shop sold came with a backup in its format. Buyers couldn't log in without installing it.

CHow you could follow Don't copy this extension; learn its playbook. Watch for the next platform that forces a new verification method, build a tool that turns new credentials back into portable data early, and get account shops or agencies to write your format into their deliveries.

Grade C: the traction came from Meta's one-time forced change plus one account shop's own channel. The gap was filled in September by built-in features in ixBrowser and MoreLogin, users dropped from 7,000, updates stopped, and it sits on the edge of platform terms. The playbook is worth learning, but following it isn't worth the effort. Few people know about it yet

6,000 users · rating 5.0 (4)

FBSTOCKER Key Hub is a Chrome extension that generates and stores passkeys inside the browser, then exports them as text or a spreadsheet, so Facebook ad accounts with passkeys can still be packaged and resold. It was built by a Russian shop selling Facebook ad accounts. It launched in 2026 August 11, right as Meta was forcing passkeys on advertisers. It reached 4,000 users in about six weeks, peaked around 7,000 in October, then fell back to 6,000 and stopped updating. Below: how it grew, where the money is, why it's already too late to chase, and what's actually worth learning from it.

A post held back until after midnight

On 2026 August 13, the Telegram channel @FB_STOCKER posted a single line: "Get ready…. 10:00 AM GMT+3". The next morning the official launch post appeared, opening with:

"Stayed up all night holding back from posting the moment it went live on the Chrome Web Store."

The post explained why they built it. In the scene, everyone says accounts with passkeys last longer and work better. They had just lost a batch of "four-year-old accounts", so they started manually installing passkeys on each one. After a day of that felt too tiring, they decided to build a tool themselves. They described an earlier product they'd used: "that clumsy backup export and import, a real love-hate relationship." The post even added a line at the end: "No vibe coding, pure craftsmanship from our tech skills."

The channel is run by fbstock.me, a Russian "ad account" shop: auto-registered Facebook accounts at $1.2–3.2 each, aged accounts that passed selfie verification and have a Business Manager (BM) at $20–33, and a full "King account + 9 ad accounts" bundle at $90 (from fbstock.me and channel posts, 10–November). Payment is in USDT, and orders go through customer service on Telegram.

What problem it solved for account farmers

For people in the Facebook ad account business, delivering an account has always meant "one line of data": login | password | 2FA seed | cookie. The buyer pastes that line into an anti-detect browser (Dolphin, AdsPower and similar, one isolated browser environment per account) and logs in to run ads.

Since August 2026, that workflow has broken. Meta has started enforcing "Advanced Protection" on advertiser and business accounts, requiring a passkey before you can log in (Jakob Strehlow's post on LinkedIn 8-14 and the Japanese marketing blog petabit's article 10-26 both cover it). The Russian paid-acquisition outlet trafficultras wrote about it in Aug 14: a passkey is tied to Windows Hello or iCloud Keychain, so it stops working when you switch browser environments, and resetting your login method easily trips risk controls and selfie verification. In the same month, Google Ads also began requiring passkeys for admins and billing users from 8-19 onward.

Legitimate password managers (Bitwarden, 1Password, Apple, Google) deliberately don't let you export passkeys. That's the point of passkey security. Key Hub does the opposite:

  • it intercepts passkey registration and login on all sites and generates and stores the private key itself;
  • it has a built-in 2FA code generator;
  • it exports to plaintext, JSON, an encrypted file, or a "one row per line" format you can paste straight into Google Sheets or Excel;
  • it can bulk-import from a pasted spreadsheet.

The store description is blunt: "One-click backup built for bulk account workflows… Built by farmers — for farmers." In this circle, a "farmer" is someone who farms accounts.

Where the 6,000 users came from

TimelineusersSources
08-11LaunchedChrome Web Store
08-211,000 (the developer says "one week since launch")Channel post no. 131
09-012,000Third-party extension stats site
09-094,000Same source; a 9-18 channel milestone post also says 4,000
10-167,000Same as above
11-066,000,4 ratings, all 5 stars, no change in 7 daysChrome Web Store

First, it's the delivery format for account sellers. August 16, channel post no. 129: "Every account now has a passkey installed, and the account data carries a backup from our extension FBSTOCKER [ Key Hub ]." In other words, anyone who buys an account from this shop can't log in without Key Hub. That's distribution more forceful than any ad.

Second, every channel post links to it. Nearly every account-sales post after that ends with a line like "The best passkey and 2FA plugin, Key Hub". It posted a milestone each time it hit 1,000 and 4,000 users.

Third, it localized by the countries where the industry is. In August 17 it added 12 languages at once, including Vietnamese, Chinese, Brazilian Portuguese, Turkish and Indonesian. The post said: "Now users in every country relevant to our industry can use it in their own language." The languages were picked by where the Facebook account supply chain operates, not by market size.

Ranked #4, with user count likely inflated by anti-detect browsers (inference). This channel has only 254 subscriptions as of 11-06, yet it drives 6,000 users. The most likely explanation: Chrome counts users per browser instance, and people running multiple accounts use one browser profile per account, so each profile installs Key Hub once. A single studio can add dozens or hundreds of "users" this way. How many real people are behind 6,000 can't be seen from the outside.

Also, all 4 ratings came in the first week after launch, signed with Russian names, with comments like "Legendary! Exactly the plugin the market was missing!" and "Insane!" They were most likely planted by insiders. Searches for it on media, X, Reddit and TikTok turn up nothing. Outside the niche, almost nobody knows about it.

Where the money comes from

The extension is free with no in-app purchases. The money is in the shop: accounts get sold, the extension goes with them, and the more installs, the more people know the fbstock.me brand. The same channel also promotes an affiliate link for Dolphin Anty and its own account-management panel, edass.pro. In September 3 they launched a second extension, "Account Hub — Facebook Account Manager", which had only 11-04 users by 26 (chrome-stats). Without a must-have event like the passkey requirement behind it, the same playbook didn't gain traction.

Who it's competing with

CompetitorsScaleHow it differs from Key Hub
ixBrowser built-in passkey (09-09)Not verifiedThe anti-detect browser hosts passkeys itself and can even spoof the authenticator model; you need its paid browser
MoreLogin built-in passkey (09-20)Not verifiedHosts passkeys per browser environment with team sharing; also locked to its own browser
Clavis — Local Passkey Vault(08-13)108 usersA local passkey extension with nearly the same features, launched two days later, with no distribution
Fenko Vault20k usersOpen-source local passkey + 2FA, aimed at privacy-minded individuals; no bulk or resale features
AdsSuite's 2FA extension315 usersFor the same Facebook advertisers, with only 2FA and autofill, no passkeys
Bitwarden / 1PasswordBitwarden 7MCan store passkeys, but doesn't allow bulk export

Among Chrome Web Store passkey extensions launched after July, none besides it has more than 120 users. The real competitors aren't in the store; they're the anti-detect browsers, which built the same capability into their products in September, and the account farmers already open those browsers every day. Key Hub fell from 7,000 to 6,000 after October, and its version has been stuck at August 28 with 1.2.1, which probably relates to this (inference).

If it were you

Verdict: Don't chase this specific product. It took off on two things you can't get: the gap from Meta's forced change in August, and an existing account shop writing the extension into its delivery format. The gap has since been filled by ixBrowser and MoreLogin, and the channel is theirs. On top of that it sits on the edge of Meta's terms and Chrome Web Store policy (full-site permissions, deliberately bypassing device binding), so it could be pulled at any time.

What's worth learning is the playbook, not the product:

  • When a platform changes its security mechanism (passkeys, selfie checks, device binding), the workflows of multi-account industries break for a while. Whoever first turns the new credentials back into "one row of data you can carry off" wins a wave of free installs. Watch whether the next one is Google Ads, Amazon seller accounts (which also require passkeys in the second half of the year), or TikTok ads.
  • Sellers who build a free tool and write its format into their deliverable do far better than those who buy ads.
  • Pick localization languages by where your users are, not by market size.

Who it's for: People already in the multi-account, cross-border ad, and agency circles, who have channels or client lists and can ship within a week of a platform rule change.

Who it's not for: Devs without in-circle channels who hope to grow from store search alone, and anyone unwilling to touch grey areas in platform terms.

If you do build it, how: Don't build "yet another passkey plugin." Watch which platform will force passkeys or a new verification method next, and get the tool ready early. Sign a deal with an account seller, an ad-buying agency, or an anti-detect browser affiliate so they write your format into their delivery. Ship the target-country languages the same week you launch.

When to move: The few weeks between a platform announcing a forced rollout and the rollout actually taking effect. Anti-detect browsers usually follow only about a month later.

Signs you've got it wrong: If Key Hub climbs back above 7,000 users after ixBrowser and MoreLogin, or if sellers outside the one shop start delivering in its format, standalone plugins have more staying power than built-in anti-detect features, and this category deserves a second look.

Chrome store page ↗

Research notes: competitor table, acquisition evidence, full research report
Competitors
NameWhereLaunchedScaleHow it differs from this one
ixBrowser Passkey moduleOther2026-09-09Not verifiedLocked inside its paid anti-detect browser, pitched on AAGUID anti-linking. Key Hub is free, installs in any Chromium browser, and exports to spreadsheets.
MoreLogin Passkey hostingOther2026-09-20Not verifiedHosted per profile, shared with the team, tied to its own browser. Came more than a month after Key Hub.
Bitwarden / 1PasswordChromePasskey support 2023–24Bitwarden 7M usersAimed at individuals and enterprises. Passkey export is restricted, and there's no bulk spreadsheet export or resale path.
Native passkeys in Chrome / iCloud / Windows HelloBig-company featuresFrom ¥2022full rangeDevice-bound and non-exportable. That's exactly what account farmers have to work around.
Fenko VaultChrome2025-12-2720k usersOpen-source local passkey + TOTP with cross-device sync. Aimed at privacy-minded individuals, not bulk or resale.
Clavis — Local Passkey VaultChrome2026-08-13108 usersLocal-software passkey with similar features, but no industry channels.
2FA Authenticator & TOTP Manager – Facebook Auto Fill (AdsSuite)Chrome2026-04-28315 usersSame FB ad-audience, but only TOTP and FB autofill, no passkey.
Authenticator (authenticator.cc) / 2FASChrome2014 / 202210M / 70kTOTP only, no passkey.
Disable PasskeysChrome2025-12-315,000 usersThe opposite approach: blocks passkey pop-ups. Doesn't work against Meta's forced flows.
Where users come from
  • Verified Launched on its own Telegram channel and kept linking to it: t.me/FB_STOCKER 8/14 published the launch post and video tutorial (126/127). After that, every account-sale post ends with a Key Hub link. 8/21 and 9/18 posted 1,000/4,000-user milestone posts.
  • Verified Written into the account-sale delivery format (distribution through sellers): post 8/16 #129: every account in the shop has passkey installed, and delivery data includes a Key Hub-format backup. From September, bulk deliveries switched to the Account Hub format.
  • Verified Localized into 12 languages for the industry's countries: 8/17 post #130: added Vietnamese, Chinese, Portuguese, Turkish, Indonesian and 12 more languages, for "all relevant countries in the industry."
  • Inferred Multiple installs across anti-detect browser profiles inflate the user count: the channel has only 254 subscribers but 6,000 users. Farmers use one profile per account, and each profile needs the extension installed to use that account's passkey.
  • Inferred Word of mouth in the community and downstream resale: the channel mentions activity in large groups like "Желтый Веб". No third-party mentions found.
  • Inferred Store search and related recommendations: among passkey extensions listed after July, it's the only one past 1,000 users. In the store, its related-items slot sits next to FB ad tools.
  • Inferred Seeded reviews: 3 of the 4 ratings with text came in the first week after listing (8/11, 8/13, 8/17). The names are clearly Russian-speaking acquaintances, and there are no other reviews.

FBSTOCKER [ Key Hub ] — Passkey & 2FA Manager: why it got traction

Chrome extension lpkfjkblaohdnlbcfdmjhopgckolalni, developer FBSTOCKER LABS (site fbstock.me, email [email protected]). Listed 2026-08-11, currently 6,000 users, 4 ratings all 5 stars, version stuck at 1.2.1 (2026-08-28). Free, no in-app purchases. Research date 2026-11-06.

Bottom line

This is a Russian-language Facebook ad account shop (fbstock.me + Telegram channel @FB_STOCKER) giving its buyers a free companion tool. Around August of 2026, Meta began pushing passkeys hard on ad and business portfolio accounts. Passkeys are device-bound and can't be exported, which broke the old flow of bundling "account + password + 2FA seed + cookies" and reselling it. Key Hub acts as a software authenticator inside the browser, turning passkeys into data you can export as text or a spreadsheet and transfer along with the account. The timing was spot on: it launched 8/11, right when Meta and Google Ads were making passkeys mandatory. And every account the shop sells comes with a passkey backup in "Key Hub format," so buyers can't use it without installing the tool. That's what drove the growth.

1. Data

TimelineusersSource
2026-08-11LaunchedStore page / extscope
2026-08-14Official Telegram channel launcht.me/s/FB_STOCKER post 126
2026-08-211,000 (the developer says "one week since launch")Post 131
2026-09-012,000extops growth curve (data card recall.found)
2026-09-094,000extops; post 9/18 #143 claims 4,000
2026-10-167,000extops
2026-11-016,000, rating 5.0 × 4Our chromestore library item_snap
2026-11-066,000extops / extscope (flat for 7 days)
  • Ratings: 4 total, 3 with text, all in the first week after listing: Yaroslav (8/11, English), "Александр Иванов" (8/13, "Легенды! Именно этого расширения не хватало на рынке!"), "Глин Глиныч" (8/17, "Пушка!"). Positive reviews appeared on listing day, and the names look like acquaintances in the Russian-speaking scene. We think these are the team's or friends' first seeded reviews (extscope review snapshot).
  • 6,000 users vs. a channel with only 254 subscribers (2026-11-06 t.me/s/FB_STOCKER). The user count is far larger than its own audience, so spread isn't coming only from its own channel (see section 3).
  • The same developer's second extension, "FBSTOCKER [ Account Hub ] — Facebook Account Manager" (khmajcdbkfenbgbgdolhampejinonddm). Listed 2026-09-03, only 26 users (chrome-stats 2026-11-04).
  • Permissions: http://*/*, https://*/*, storage, unlimitedStorage (injects a WebAuthn interceptor on every site).

2. What it is and where the money comes from

  • Features (store description): intercepts WebAuthn registration/login on all sites, generates and saves passkeys itself using ECDSA P-256 (pick or create with one click in an on-page pop-up); built-in TOTP; local AES-256-GCM encryption with a master password; export as plaintext, JSON, an encrypted .keyhub file, and a "one row per line" table format that pastes straight into Google Sheets/Excel; bulk import by pasting from a table. The description reads, verbatim: "Instant and effortless backup copying built for bulk account workflows. Built by farmers — for farmers."
  • Money: the extension itself is free. fbstock.me is a Russian-language "ad accounts" shop: FB auto-registration at $1.2–3.2, "farmed" accounts with BM250 or video-selfie verification at $20–33, Firstmail inboxes at $0.1. The channel sells a "setup King + 9 business managers" bundle at $90 per set (October promo $75–80). Payment is in USDT, orders via private TG chat @fb_stock (per the fbstock.me page and front-end JS, and channel post 144/149/156). The shop also promotes a Dolphin Anty affiliate link (dolphinru.ru), its own edass.pro (account warming / 2FA / randomization panel), and BUSINESSBERG (a BM management extension).
  • Funnel: post 2026-08-16 #129: "Every account now has Passkey installed, and the account data includes a backup for our FBSTOCKER [ Key Hub ] extension." In other words, every account sold already has a passkey bound, and the delivery data includes a Key Hub-format backup, so buyers have to install it to log in. Bulk setup deliveries from September on switched to the Account Hub format (post 144/155).

3. Where users came from (growth tactics)

  1. Launch on its own Telegram channel, with repeated links back (confirmed): 8/13 teased "Get ready… 10:00 AM GMT+3". 8/14 posted the launch with a video tutorial (posts 126 and 127). After that, nearly every account-sale post ends with "Top extension for working with Passkey and 2Fa — FBSTOKER Key Hub" (posts 136, 137, 139, 140). 8/21 and 9/18 each posted a milestone (1,000 / 4,000 users) as social proof.
  2. Built the extension into account delivery (confirmed): passkey backups are delivered only in Key Hub format (post 129). Buyers don't just install it themselves; they also split accounts across teams and keep using that format when they resell.
  3. Localized into 12 languages, aimed at the countries where the industry operates (confirmed): 8/17 update added EN/RU/VN/ZH/PT-BR/ES/DE/PL/UA/TR/ID/FR. The post says: "Now users from all active countries in our industry can use it" (post 130). These are the hubs of the FB ad-account supply chain: Vietnam, China, Brazil, Turkey, Indonesia, and others.
  4. User count inflated by anti-detect browsers (inferred, not verified): a channel with 254 subscribers accounts for 6,000 users. A plausible explanation is that Chrome counts users per browser instance. Farmers run one profile per account in anti-detect browsers like Dolphin or AdsPower, and each profile has to install Key Hub to use that account's passkey. One studio can add dozens or hundreds of "users." Add downstream resale and community word of mouth (the channel mentions large groups like "Желтый Веб", post 152).
  5. Store search (partial): among extensions that come up for "passkey," the only one listed after July that's past 1,000 users is this one. Our library shows everything else from the same period under <120 users. The store's "related" slot puts it next to FB ad tools like AdsSuite 2FA, Meta Ads Toolkit, and Ads Check (store page Related).
  6. Not found: no press coverage, X, Reddit, TikTok, or ad campaigns. Searches for "FBSTOCKER" and "fbstock.me" on Jina, Brave, and Exa only return the store page and extension aggregator sites. x-radar returned 0 results for fbstock.

4. Why now: a platform event

  • Meta began promoting passkeys in Accounts Center around 2025-06. In 2026, starting August, Meta turned on "Advanced Protection" for advertiser and business-portfolio users, requiring a passkey to be set up or the account can't be accessed (LinkedIn post by Jakob Strehlow 2026-08-14, "Meta macht Passkeys für Werbetreibende verpflichtend"; petabit 2026-10-26 article: complaints on English X from August onward, growing in October; awarexone 2026-10-20).
  • Russian-language arbitrage media trafficultras 2026-08-14 feature: passkeys break the resell flow of "логин + пароль + Base32 TOTP seed + cookie JSON"; passkeys bound to Windows Hello / iCloud Keychain can't be used with anti-detect profiles, and resetting login factors easily triggers checkpoints/selfie verification.
  • Around the same time, Google Ads began requiring passkeys for all admin, billing and standard users from 8/19, and Amazon Seller Central will follow later this year (per an ixBrowser 2026-09-09 blog post).
  • Developer's own account (126 post): their accounts can have passkeys that "last longer and work better." After a batch of 4-year-old accounts got banned, they started adding passkeys to every account by hand. It was too tedious, and they found existing similar tools had "clunky export and import of backups," so they built their own. So the need came from their own storefront, and the tool was released to the public as a side effect.

5. Competitors

NameWhereLaunchedScaleHow it differs from Key Hub
ixBrowser Passkey moduleOthers (built into anti-detect browsers)2026-09-09ixBrowser users (unverified)Browser-level passkey storage, with 4 AAGUID spoofing to prevent linking. You must use their browser, and it's paid. Key Hub is free and works in any Chromium browser (including Dolphin) once installed.
MoreLogin Passkey hostingOthers (built into anti-detect browsers)2026-09-20Not verifiedPer-profile storage with team sharing. Also tied to its own browser. Launched more than a month after Key Hub.
Bitwarden / 1PasswordChrome / big-company gradeEarly days; passkeys 2023–24Bitwarden 7MCan store passkeys, but export is restricted (CXP is just getting started and mostly can't export on desktop). Aimed at individuals and enterprises, with no bulk spreadsheet export.
Native passkeys in Chrome / iCloud / Windows HelloBig-company featuresFrom ¥2022full rangeBound to device or cloud account, no export. That's exactly what account operators need to get around.
Fenko VaultChrome2025-12-2720k users, 2 ratingOpen-source local passkey + TOTP, with cross-device sync over Nostr. Aimed at privacy-focused individuals; doesn't pitch bulk or resale use.
Clavis — Local Passkey VaultChrome2026-08-13108Nearly the same function (local desktop passkey software), but no sales channel.
Passkey Manager — Stack Intelligence / Authn8 / CoauthChrome2025-10 to 2026-0838–73Team-shared passkeys, positioned as a compliant SaaS.
Passkeys.Tools InterceptorChrome / developer tools2026-0263For developers debugging WebAuthn.
2FA Authenticator & TOTP Manager – Facebook Auto Fill (AdsSuite)Chrome2026-04-28315Same Facebook ad audience. Has TOTP and FB autofill, but no passkeys.
Authenticator (authenticator.cc), 2FAS and other TOTP extensionsChromeFrom ¥201410M / 70kTOTP only, no passkey.
Disable PasskeysChrome2025-12-315,000Reverse approach: blocks passkey prompts. Doesn't work for Meta's enforced flows.
Web TOTP generators like 2fa.live and fbstock.com/tools/2faWebYearsNot verifiedOld tools in the arbitrage scene, only handle TOTP.

(Chrome data from our chromestore library, 2026-11 snapshot.)

6. Differentiation

  • It's not "yet another passkey manager." It treats passkeys as portable account assets: software-generated private keys, plaintext/spreadsheet export, and bulk paste import. Compliant products (Bitwarden, Apple, Google) deliberately stop you from doing this. Anti-detect browsers do it, but lock it inside their own browser and launched a month later.
  • It comes from people who sell accounts, so its format matches the industry's "one line per account" data (login|password|2FA|cookie on one line), and it ships with its own distribution: every account sold carries it.
  • The differentiation is why it took off, but timing mattered too: Meta's August push for passkeys created the need, and at the same time this was the only tool built for that crowd.

7. Visibility and copycats

  • Visibility: few people know about it yet. No public revenue, no coverage from big media or X accounts. It only appears in a 254-subscriber Russian Telegram channel and extension aggregators (extscope, chrome-stats, myext, crxsoso).
  • Copycats: I found no obvious copies on Chrome (extensions listed after July that mention passkeys all have <120 users besides it). The real threat is anti-detect browsers ixBrowser (9/9) and MoreLogin (9/20) building the same capability into their products. This may also explain why its user count fell from 7k after October to 6k and stopped updating after August (inference).

8. What to borrow

  • When a platform changes its security mechanisms (passkeys, selfie verification, device binding), workflows in gray or multi-account industries break for a while. Whoever first offers a tool that turns new credentials back into portable data wins a wave of free installs.
  • Sellers who build free tools and write the tool's format into their deliverables get distribution that's more reliable than paid ads.
  • Localize for the countries where the industry operates, not just the biggest markets.
  • Caution: tools like this sit on the edge of Meta's terms and Chrome Web Store policy (full-site permissions plus bypassing device binding), so they could be pulled at any time. The revenue isn't in the tool; it's in selling accounts.

9. Uncertain

  • It's impossible to verify how many of the 6,000 users are distinct people versus repeated counts from anti-detect profiles.
  • Unverified: whether WebAuthn interception is stable in anti-detect browsers like Dolphin and AdsPower, and whether Meta can detect software authenticators (via AAGUID).
  • No evidence found that downstream resellers deliver accounts in the Key Hub format.
  • The reason for the drop from 7k to 6k in October is uncertain (anti-detect browsers bundling the feature / accounts being banned / store-count fluctuation).

Sources

This article was written by AI from public data and the data we collect daily. Numbers are sourced, and inferences are labeled.