Media
4 items
Description
Autofill and save logins from your Uzavik Vault. Requires the Uzavik Vault desktop app and your VaultKey. Uzavik Vault brings the logins already stored in your Uzavik Vault desktop app into Chrome, so you can fill a sign-in form without retyping a password or copying one through the clipboard. This extension is a companion, not a password manager on its own. It stores nothing. Every credential lives in the Uzavik Vault Windows application on your own PC, encrypted and locked to your VaultKey USB device. The extension asks that application for a single password, for a single site, at the moment you ask it to — and forgets it immediately afterwards. BEFORE YOU INSTALL You need all three of these. The extension cannot work without them: • Windows 10 or Windows 11 • The Uzavik Vault desktop application, installed and running • Your Uzavik VaultKey USB device, plugged in If any of these is missing, the extension will tell you which one and do nothing else. There is no cloud fallback, no online account, and no way to sign in from a browser alone. That is deliberate. WHAT YOU CAN DO Fill a saved login Open a sign-in page, click the Uzavik Vault icon, and the popup lists the logins saved for that exact site. Click one and the username and password go straight into the page's fields. The form is never submitted for you — you review what was filled and press the site's own sign-in button yourself. Choose between multiple accounts Plenty of people keep a work account and a personal account on the same site. Every matching login is listed with its real username so you can tell them apart at a glance. Once there are more than a handful, a search box appears above the list so you can type a few characters instead of scrolling. Save a new login as you create it Fill in a sign-up or sign-in form as usual, then click the extension and choose "Save this login". It reads the username and password you just typed and writes them into your vault. If a login for that site already exists, the extension offers to update it instead of creating a duplicate. Add a login by hand Some sign-in flows are split across pages, or use a passcode you were given elsewhere. "Enter manually" gives you a plain form — username, password, and an optional note — that saves against the site you are currently on. Keep secret notes with a login Recovery codes, backup PINs, security question answers and account numbers can be stored alongside the password. Notes are treated as a secret, not as a label: they are never shown in any list and never travel with an ordinary fill. You see a note only when you explicitly ask to reveal that one login's note, and an ordinary password update never overwrites a note you wrote in the desktop app. Browse everything you have saved The "All logins" section lists every entry in your vault so you can check whether a site is already saved before creating a duplicate. Usernames in this cross-site list are masked, and no passwords are ever sent to the browser for it. Choosing an entry opens that site so you can fill it there. Generate a strong password The built-in generator produces passwords from 8 to 64 characters, using a cryptographically secure random source with unbiased sampling, and always includes a lower-case letter, an upper-case letter, a digit and a symbol. Easily confused characters — l, I, O, 0 and 1 — are left out so a password stays readable if you ever have to type it on a phone or read it aloud. Generation happens entirely inside the browser; the generator never contacts your vault or anything else. HOW IT IS BUILT It only runs when you click it There are no content scripts and no site permissions. The extension is not loaded into the pages you visit, does not watch you type, and does not sit in the background scanning forms. It touches a page only in the moment you click the toolbar icon, using Chrome's activeTab permission, and it is gone again as soon as the popup closes. Browsing with the extension installed but unused is indistinguishable from browsing without it. Your desktop app decides, the extension only asks The browser side has no authority. It cannot decide that a site matches a credential, cannot decide whether the vault is unlocked, and cannot decide that a password may be released. Each request is re-checked by the desktop application, which holds the encryption keys and the matching rules. If the vault is locked, or the VaultKey is unplugged, or the site does not match, the answer is simply no — there is nothing in the browser to talk around. Site matching is strict, because phishing is the real threat A password is offered only over HTTPS and only to an exact origin match. A page that merely looks like your bank, or lives on a similar-looking domain, gets nothing. If a login form is inside an embedded frame, the extension fills it only when that frame's own origin is the same as the page's — a frame from somewhere else is skipped, which is the pattern behind a number of credential-stealing techniques. Each fill is authorised once Permission to read a specific password is single-use and short-lived. It is granted only by a search you initiated for the site you are actually on, it expires within seconds if you do not act, and it is consumed the moment it is used. Locking your vault, unplugging the VaultKey or closing the browser invalidates everything immediately. The channel to your vault is encrypted The extension talks to the desktop application through a local, authenticated, encrypted channel on your own machine — nothing crosses the network, not even your loopback interface in the ordinary sense. The two ends verify each other's identity before a single byte of vault data moves. The popup never holds a secret The window you interact with is presentation only. It never opens the connection to your vault, never receives an authorisation to read a password, and never handles a stored password. The only secrets it ever touches are the passphrase you type to unlock and a password you type in by hand — and both are cleared from memory as soon as the request finishes. PRIVACY • No data is collected. Not usage statistics, not error reports, not the sites you visit. • Nothing is stored in the browser. Not in extension storage, not in local storage, not in a cache, not in a cookie. • No servers are contacted. The extension has no network permissions at all and makes no outbound requests of any kind. Its only communication partner is the Uzavik Vault application on the same computer. • No account is required and none exists. There is no sign-up, no email address, no subscription check. • Your passwords are never transmitted anywhere, never synced, and never leave your PC. PERMISSIONS, AND WHY EACH ONE IS THERE nativeMessaging — the only way a browser extension can talk to a locally installed application. This is how it reaches your vault. It is restricted to one specific application, Uzavik Vault, and cannot reach any other program. activeTab — grants access to the single tab you are looking at, and only at the moment you click the extension's icon. This is what lets it read the address of the site you are on so it can ask for the right login. It is not a permission to read your browsing history, and it does not cover any other tab. scripting — used to place a small, one-time helper into the current page so it can find the username and password fields and put values into them. It is injected on click and never persists. There is deliberately no "read and change all your data on all websites" permission. That is the broad access most autofill extensions request, and this one is designed so it is not needed. WHAT THIS EXTENSION WILL NOT DO • It will not delete anything. Adding and updating are the only writes it can perform. Deleting a login, renaming it, or managing the vault itself is done in the desktop app, so a compromised browser cannot destroy your data. • It will not submit a form for you. Autofill stops at filling. You always press sign-in yourself. • It will not show a drop-down inside the website's own password box. That convenience would require running code on every page you visit, which is exactly the access this design gives up. The list lives in the extension popup instead. • It will not fill over plain HTTP, and will not fill a cross-origin frame. • It will not work on macOS, Linux, or ChromeOS, because the vault application it depends on is Windows-only. GETTING STARTED 1. Install the Uzavik Vault desktop application on your Windows PC and create a vault on your VaultKey. 2. Plug in your VaultKey. 3. Install this extension and pin it to the toolbar so the icon is always reachable. 4. Click the icon and unlock with your passphrase. The vault stays unlocked until you lock it, close the desktop app, or remove the VaultKey. 5. Visit a sign-in page and click the icon. Saved logins for that site appear at the top; if there are none, use "Save this login" after you have typed your credentials. TROUBLESHOOTING "Insert your VaultKey" — the USB device is not plugged in, or Windows has not finished recognising it. "Vault locked" — unlock with your passphrase in the popup, or in the desktop app. A message about the desktop application not being reachable — the Uzavik Vault service is not running, or the desktop app needs updating to a version that recognises this extension. Reinstalling or updating the desktop app resolves it. "No saved logins match this site" — nothing is stored for this exact origin yet. Use "Save this login" or "Enter manually" to add one, or check "All logins" in case it was saved under a different address. SUPPORT Questions, bug reports and feedback are welcome through the support link on this listing. Because the extension holds no data of its own, uninstalling it never puts a credential at risk — everything stays in your vault, on your PC, on your VaultKey.