Aperture Vault · Exact Autofill

A local encrypted vault that matches credentials by scheme, host, and port.

Aperture Vault is a local-first password manager for Chrome and Microsoft Edge. It keeps credentials encrypted in the current browser profile and matches sign-in pages by exact scheme, hostname, and effective port, so accounts for different protocols or ports are not silently mixed together. Key features: - Encrypts the entire vault with AES-256-GCM. The master password is never stored and cannot be recovered by the developer. - Shows a compact account picker beside sign-in fields. Choose with the Arrow keys and fill with Enter, or use the Ctrl + Shift + L shortcut. - Matches the exact scheme, hostname, and port by default. An optional path prefix can narrow a credential further, but matching never broadens silently to a top-level domain. - Searches name, username, origin, port, path, and notes with multiple terms. Search supports Chinese text, full Pinyin, Pinyin initials, English initials, and conservative typo tolerance. Password contents are never indexed or searched. - Offers a separate, per-origin option to ask before saving or updating after a sign-in submission. It reads a username and password once only after a trusted native form submission on an explicitly enabled exact HTTPS origin, then requires confirmation before writing or replacing anything. It does not claim that the sign-in succeeded and never saves silently. - Creates, views, copies, edits, and deletes credentials, and provides encrypted backup export plus verified preview and rollback-protected restore. - Generates strong random passwords locally (12–64 characters; default 20). On recognized HTTPS registration or password-change forms, explicitly use a generated password in the new and confirmation fields, then review its save/update. It never submits the form or fills the current-password field with the new password. - Keeps encrypted recovery for the latest 20 generated passwords for 30 days, and the ten most recent replaced passwords per credential. History restore changes only the local vault, not the website account. Expired generated records are removed on the next unlocked vault access; exported backups retain their own encrypted snapshots. - Auto-locks after 15, 30, or 60 minutes, 4 or 8 hours of Vault inactivity, or can stay unlocked for the current browser session. Manual lock, fully exiting the browser, and reloading, updating, or disabling the extension still lock it. - Provides Simplified Chinese, English, and Follow browser language choices, plus light, dark, and Follow system themes. Privacy and permissions: Aperture Vault has no remote server, cloud sync, advertising, analytics, or telemetry. Credentials, searches, site information, and usage history are not sent to the developer or third parties. Site access is optional and requested only after the user explicitly enables automatic candidates or post-submit save prompts for the current site. When no enabled feature still needs that access, the extension attempts to revoke it. Known boundaries: This release does not provide cloud or cross-device sync, passkey management, or master-password recovery. Automatic save prompts use deliberately conservative detection and cover secure native single-password sign-in forms. A form-less sign-in implemented entirely with fetch/XHR can still be handled through the explicit “Read and save current login” confirmation flow. Generated filling requires a high-confidence HTTPS new-password form and checks the selected fields again before filling. Ambiguous, changed, cross-origin or incompatible fields are refused; manual use remains available through the manager. The extension cannot determine whether a website accepted a new password.