You only have to set a password the first time you open the addon (you will have to provide that password every time you open the addon). Then, you can add or delete domains that will be blocked.
The password is not saved as plain text (it uses the Hashify API), therefore that increase the security of the addon.
