AutoFill in your browser
Password Safe for Windows fills website logins through a browser extension. Four steps, one verification code — and nothing ever leaves your PC.
Firefox and Safari are not supported yet. The extension does nothing on its own — it needs the Windows app.
01How it works
Your vault stays where it is: encrypted on your PC, managed by the desktop app. The extension has no vault of its own and no server behind it. When you want a login, it asks the app for one that matches the page you are on — and the app answers only after you have picked an entry.
The extension
Asks for a matching login
Password Safe
Holds the vault, decides, answers
The internet
Never involved
02Set it up
You only do this once per browser. Nothing here needs an account, and none of it costs anything — browser AutoFill is part of the free Windows app.
Install Password Safe for Windows
Get the app from the Microsoft Store, make sure it is up to date, then create or restore your vault and unlock it.
The extension is only the browser half of the feature. It can neither hold nor unlock your vault, so the app has to be running and unlocked whenever you want something filled.
Turn on browser autofill in the app
In Password Safe, go to Menu → Settings → Browser autofill and switch Browser autofill on. It is off by default. The subtitle then reads “Waiting for the browser extension on port …” — that is the app listening on your own machine.
These settings apply to this PC only. They are not stored in your database and do not sync to your phone or tablet.
Add the extension to your browser
Install it from your browser's store, then pin it to the toolbar so the icon is always within reach.
Other Chromium browsers can usually install from one of these two stores. Firefox and Safari are not supported yet.
Connect the two, once
Click the extension icon. It shows a verification code, and the Password Safe window comes to the front showing one too. Compare them, then choose Connect in both places.
In the app you have to click Connect — pressing Enter does not confirm it. And if the two codes differ, do not connect: another program may be pretending to be your browser.
That's it. Open a login page, click the extension icon, pick the entry.
03Everyday use
Fill a login
- Open the login page and click the Password Safe icon in the toolbar.
- Matching entries are listed, each labelled exact address, same site or by name so you can see why it was offered.
- Click the one you want. Username, password and — if the entry has one — the current one-time password are filled.
Nothing is ever filled without your click. There is no silent background filling.
When nothing matches the page
- Choose Choose an entry… and search your vault by name.
- Tick Always use for this site before filling, and the entry will be offered here from now on.
This is the usual fix for entries that were saved without a website address, and for sites that log you in on a different domain.
Save or update a login from the browser
Sign in with credentials the app doesn't know yet and the popup offers Save login. If the password you used differs from the stored one, it offers Update password instead. Both write straight into your vault.
If the vault is locked at that moment, the pending login waits: unlock Password Safe and reopen the popup to finish saving it.
While the vault is locked
The extension knows the vault is locked and says so instead of filling. Unlock Password Safe, then reopen the popup — requests are never queued up and replayed behind your back, and no credentials are cached to work around a lock.
04What gets offered, and to whom
Everything below lives in Settings → Browser autofill in the Windows app.
- Site matching. Per entry, choose how closely the address has to match before it is offered: Same site, Exact address or Never offer.
- Never fill on subdomains. Offer an entry only when the address matches exactly, not for any subdomain of it.
- Match entries by name. Also offer an entry whose title contains the site's name, for entries saved without a web address. Shown below any address match, as a weaker suggestion.
- Connected browsers. Every browser you have paired, with the date it was connected — and a Disconnect button that revokes it immediately.
- Recent activity. What your browsers have asked for since the app started, refusals in bold. The list is never saved and disappears when you close the app.
All of these are stored on this PC only, in your Windows user profile. They are not part of your database, so they do not sync to Android or iOS.
05What stays private
AutoFill does not change the promise the rest of the app makes. There is still no server, no account and no analytics.
- No internet. The extension contacts no remote host. It talks only to the app on your own computer, over the loopback address
127.0.0.1, which does not leave the machine. - Encrypted end to end. The connection is encrypted (X25519, ChaCha20-Poly1305) and paired to your machine by the code you confirmed. The key is stored under Windows user protection and can be revoked at any time.
- Each frame is matched against its own address. A login form embedded from another site is labelled as such and never receives the wrong password.
- No browsing history. The extension stores only its own key pair, the paired app's public key and the port it last used.
- Your click is the gate. The page's address, the usernames that match it and — only after you pick one — that entry's password are all that ever crosses the connection.
The full detail is in the Privacy Policy.
06Troubleshooting
127.0.0.1, allow them for your browser.Still stuck?
Tell us which browser you're using and what the popup says, and we'll work it out with you.