How to Use Autofill and the In-Form Menu

CE

Pro

Cloud

When the browser extension recognises a login form, it adds its own icon to the fields. From there you can fill a credential in one click, generate a password, or save what you have just typed, without ever opening the passbolt tab.

The icon in the form

The icon appears in the fields passbolt has detected, and it carries a badge with the number of credentials it has for the page: from 1 to 5, then "5+" beyond that. You can therefore tell at a glance whether you have something for this site, before clicking anything.

fig. The passbolt icon in a login form, with its badge

The icon stays there even when you are not signed in to passbolt, but in an inactive state, and it suggests nothing until you have signed in and completed your multi-factor verification.

What the menu offers

Clicking the icon opens the in-form menu. Your matching credentials come first, each showing the name of the resource and its username. Click one and the form is filled. On a one-time password field, the entry also shows the countdown of the code.

Below them come the actions, each with its own explanation:

• Generate a new password securely, "You will be able to save it after submitting".
• Save as new credential, "Save the data entered as a new credential".
• Create a new credential, "Create and customize it yourself".
• Browse credentials, "Search among available credentials".

Which of them you get depends on the field you clicked and on whether it already holds something:

Where you click	What you get
An empty username field	Create a new credential, then Browse credentials
A username field you have filled in	Save as new credential, then Browse credentials
An empty password field	Generate a new password securely, Create a new credential, then Browse credentials
A password field you have filled in	Save as new credential, then Browse credentials
A one-time password field	Browse credentials only

fig. The in-form menu, opened from a password field

Suggestions always come first and Browse credentials always comes last, so the menu reads the same way whatever the context.

Save a credential from a login form

You do not have to think about it: when you submit a login form with something in the username or the password field, passbolt offers to save it. The Quick Access popup of the extension opens on its saving screen, with the fields already filled in for you:

• the name is the title of the page, as it appears in the browser tab,
• the URI is the address of the page you were on, without the query string or the anchor,
• the username and the password are what you typed.

Nothing is stored until you confirm in the popup, and you can correct any of it before you do. The page title in particular tends to be long and vague, so it is usually worth rewriting into something you will recognise in your list.

Submitting is not succeeding

The offer to save is triggered by the submission of the form, not by a successful login. passbolt has no way of knowing whether the password you just sent was the right one, so you may well be offered to save a password that does not work. Save once you know you are in.

If you would rather not wait for the submission, Save as new credential in the menu does the same thing from what is currently in the form.

Which credentials are suggested

passbolt matches on the host of the address, and ignores the rest of it entirely:

• The same host always matches.
• A URI saved on a parent domain matches its subdomains, so example.com is suggested on app.example.com. The reverse does not hold: a credential saved on app.example.com is not offered on example.com. This only applies to names that contain a dot, so an internal host such as intranet has to match exactly.
• An IP address has to match exactly, in both directions.
• The protocol and the port only count when your saved URI mentions them. A credential saved as https://example.com is not offered on the http:// version of the site, while one saved without a protocol is offered on both.
• The path is ignored, which is why a credential saved from a login page is suggested everywhere on that site.

The suggestions are also filtered by what the field needs, so a one-time password field only offers resources that carry one, and a password field only offers resources that carry a password. The same site can therefore propose different entries depending on where you click. There is no limit to how many are listed, and the most relevant come first.

When nothing matches, no message says so: the menu simply shows its actions and no suggestions.

When you see nothing at all

• A greyed out icon means you are not signed in, or that your multi-factor verification is still pending.
• No icon anywhere, on any site, points at your organisation rather than at the page: the in-form integration can be switched off on the server side, which removes both the icon and the menu. Filling from the Quick Access popup keeps working in that case, which is how you can tell this apart from a site that passbolt cannot read.
• A click with no effect can come from a safety measure: when passbolt detects that another application is drawn over the page, it interrupts the action rather than risk filling a form it cannot see properly.
• No icon on one particular site usually means the form itself cannot be detected, which is covered by why you cannot use autofill.