Uzavik Vault

Autofill and save logins from your Uzavik Vault. Requires the Uzavik Vault desktop app and your VaultKey.

Uzavik Vault brings the logins already stored in your Uzavik Vault desktop app into Chrome, so you can fill a sign-in form without retyping a password or copying one through the clipboard. This extension is a companion, not a password manager on its own. It stores nothing. Every credential lives in the Uzavik Vault Windows application on your own PC, encrypted and locked to your VaultKey USB device. The extension asks that application for a single password, for a single site, at the moment you ask it to — and forgets it immediately afterwards. BEFORE YOU INSTALL You need all three of these. The extension cannot work without them: • Windows 10 or Windows 11 • The Uzavik Vault desktop application, installed and running • Your Uzavik VaultKey USB device, plugged in If any of these is missing, the extension will tell you which one and do nothing else. There is no cloud fallback, no online account, and no way to sign in from a browser alone. That is deliberate. WHAT YOU CAN DO Fill a saved login Open a sign-in page, click the Uzavik Vault icon, and the Logins tab lists the logins saved for that exact site. Click one and the username and password go straight into the page's fields. The form is never submitted for you — you review what was filled and press the site's own sign-in button yourself. Choose between multiple accounts Plenty of people keep a work account and a personal account on the same site. Every matching login is listed with its real username so you can tell them apart at a glance, and a search box above the list narrows it as you type. Save a login as you sign in Type your username and password into a site's sign-in or sign-up form as usual, then click the extension and open the Add tab. The form opens already filled in from what you typed on the page, so you only check it and press Save. If a login for that site already exists, the extension offers to update it instead of creating a duplicate. The Add tab is available only on a page that actually has a login field. Add or correct a login by hand The same form works when there is nothing to read — a sign-in split across several pages, or a password you were given elsewhere. Type the username, password and an optional note, and it saves against the site you are currently on and fills the page for you. Keep secret notes with a login Recovery codes, backup PINs, security question answers and account numbers can be stored alongside the password. Notes are treated as a secret, not as a label: they are never shown in any list and never travel with an ordinary fill. You see a note only when you explicitly ask to reveal that one login's note, and an ordinary password update never overwrites a note you wrote in the desktop app. Generate a strong password The Generator tab produces passwords from 8 to 128 characters using a cryptographically secure random source with unbiased sampling. You choose which character types to include, can set a minimum number of digits and symbols for sites that demand them, and can add a fixed prefix or suffix. Easily confused characters — l, I, O, 0 and 1 — are left out by default so a password stays readable if you ever have to type it on a phone or read it aloud. Generation happens entirely inside the browser; the generator never contacts your vault or anything else. Fill a generated password straight into a field When a site asks you to choose a new password, right-click the password box and choose "Fill a generated password", or press Alt+Shift+P. A strong password is generated and typed into the box — and into the confirmation box, if the form has one — without opening the popup. Then save the login from the Add tab. HOW IT IS BUILT It only runs when you ask it to There are no content scripts and no site permissions. The extension is not loaded into the pages you visit, does not watch you type, and does not sit in the background scanning forms. It touches a page only in the moment you invoke it — by clicking the toolbar icon, choosing its right-click menu item, or pressing its keyboard shortcut — using Chrome's activeTab permission, and only for that one tab. Browsing with the extension installed but unused is indistinguishable from browsing without it. Your desktop app decides, the extension only asks The browser side has no authority. It cannot decide that a site matches a credential, cannot decide whether the vault is unlocked, and cannot decide that a password may be released. Each request is re-checked by the desktop application, which holds the encryption keys and the matching rules. If the vault is locked, or the VaultKey is unplugged, or the site does not match, the answer is simply no — there is nothing in the browser to talk around. Your passphrase never enters the browser The extension has no passphrase field and cannot pass one to your vault. You unlock in the Uzavik Vault desktop app. On a PC you have already marked as trusted in the desktop app, the popup can also offer "Unlock with this device", which asks the desktop app to use that PC's own protection — no passphrase or recovery key is sent from the browser. Site matching is strict, because phishing is the real threat A password is offered only over HTTPS and only to an exact origin match. A page that merely looks like your bank, or lives on a similar-looking domain, gets nothing. If a login form is inside an embedded frame, the extension fills it only when that frame's own origin is the same as the page's — a frame from somewhere else is skipped, which is the pattern behind a number of credential-stealing techniques. Each fill is authorised once Permission to read a specific password is single-use and short-lived. It is granted only by a search you initiated for the site you are actually on, it expires within seconds if you do not act, and it is consumed the moment it is used. Locking your vault, unplugging the VaultKey or closing the browser invalidates everything immediately. The channel to your vault is encrypted The extension talks to the desktop application through a local, authenticated, encrypted channel on your own machine — nothing crosses the network, not even your loopback interface in the ordinary sense. The two ends verify each other's identity before a single byte of vault data moves. The popup never holds a stored password The window you interact with is presentation only. It never opens the connection to your vault, never receives an authorisation to read a password, and never handles a password from your vault — those go only to the page. The only password it ever touches is one you typed yourself, into the Add form or into the site's own login box, and it is cleared from memory as soon as the save finishes. PRIVACY • No data is collected. Not usage statistics, not error reports, not the sites you visit. • No credentials are stored in the browser. Not in extension storage, not in a cache, not in a cookie. The only thing the extension remembers is which colour theme you picked for the popup. • No servers are contacted. The extension has no network permissions at all and makes no outbound requests of any kind. Its only communication partner is the Uzavik Vault application on the same computer. • No account is required and none exists. There is no sign-up, no email address, no subscription check. • Your passwords are never transmitted anywhere, never synced, and never leave your PC. PERMISSIONS, AND WHY EACH ONE IS THERE nativeMessaging — the only way a browser extension can talk to a locally installed application. This is how it reaches your vault. It is restricted to one specific application, Uzavik Vault, and cannot reach any other program. activeTab — grants access to the single tab you are looking at, and only at the moment you invoke the extension: its icon, its right-click menu item, or its keyboard shortcut. This is what lets it read the address of the site you are on so it can ask for the right login. It is not a permission to read your browsing history, and it does not cover any other tab. scripting — used to place a small, one-time helper into the current page so it can find the username and password fields and put values into them. It is injected when you invoke the extension and never persists. contextMenus — adds the single "Fill a generated password" item to the right-click menu, shown only on form fields on HTTPS pages. It gives no access to page content by itself. There is deliberately no "read and change all your data on all websites" permission. That is the broad access most autofill extensions request, and this one is designed so it is not needed. WHAT THIS EXTENSION WILL NOT DO • It will not delete anything. Adding and updating are the only writes it can perform. Deleting a login, renaming it, or managing the vault itself is done in the desktop app, so a compromised browser cannot destroy your data. • It will not submit a form for you. Autofill stops at filling. You always press sign-in yourself. • It will not list your whole vault. The popup shows only the logins saved for the site you are on, so no account for any other site reaches the browser. • It will not ask for your master passphrase. Unlocking happens in the desktop app. • It will not show a drop-down inside the website's own password box. That convenience would require running code on every page you visit, which is exactly the access this design gives up. The list lives in the extension popup instead. • It will not fill over plain HTTP, and will not fill a cross-origin frame. • It will not work on macOS, Linux, or ChromeOS, because the vault application it depends on is Windows-only. GETTING STARTED 1. Install the Uzavik Vault desktop application on your Windows PC and create a vault on your VaultKey. 2. Plug in your VaultKey and unlock the vault in the desktop app. It stays unlocked until you lock it, close the desktop app, or remove the VaultKey. 3. Install this extension and pin it to the toolbar so the icon is always reachable. 4. Visit a sign-in page and click the icon. Saved logins for that site appear on the Logins tab; if there are none, type your credentials into the page and use the Add tab to save them. TROUBLESHOOTING "Insert your VaultKey" — the USB device is not plugged in, or Windows has not finished recognising it. "Vault locked" — unlock in the Uzavik Vault desktop app, or use "Unlock with this device" if the popup offers it. The popup notices the unlock on its own. A message about the desktop application not being reachable — the Uzavik Vault service is not running, or the desktop app needs updating to a version that recognises this extension. Reinstalling or updating the desktop app resolves it. "No saved logins match this site" — nothing is stored for this exact address yet. Use the Add tab to save one. If you saved it under a different address, check the desktop app. The Add tab is greyed out — the page has no username or password box for the extension to work with. Open the site's sign-in page and try again. SUPPORT Questions, bug reports and feedback are welcome through the support link on this listing. Because the extension holds no data of its own, uninstalling it never puts a credential at risk — everything stays in your vault, on your PC, on your VaultKey.