Passbox can get help from an AI model for two tasks. This is optional and off by default. You bring your own model, and your secrets never reach it. Passbox runs no AI itself and never sees your requests.
AI agents that work with your secrets have their own page: AI agents.
What the AI does
| Feature | What it does | What goes to the model |
|---|---|---|
| Import: suggest how columns are assigned | Suggests which column is which field when you import a CSV file | The column headers and a pattern per column, for example "mostly six-digit numbers". Never values. |
| Security check: explain and prioritise | Writes the steps in Your plan in plain language | The kinds of problems, how many there are and a category per website such as "email" or "banking". Cloud providers get placeholders such as "Site A" instead of domains. |
Both work without AI too. The suggestions then come from fixed rules on your device. Passwords, hidden fields, 2FA keys, card numbers, usernames, titles and notes never go to a model, not even to one on your own computer.
Turn it on
- In the web app, open Settings → AI features (optional) and turn on Use AI features.
- Choose where the model runs (see below).
- Turn on each feature separately. Each one says what it sends and where.
Before data goes to a cloud provider, Passbox asks and names the provider and region. The setting applies to your account in this browser.
Where the model runs
- On this device: the browser's built-in model or a model server on your computer.
- Your own server: an OpenAI-compatible server you run, for example with Ollama, vLLM, LocalAI or LiteLLM.
- Cloud provider: with your own API key. Presets exist for Mistral (France), IONOS (Germany), STACKIT (Germany), Scaleway (France), Langdock (Germany), OpenAI (USA) and Anthropic (USA).
You store the API key as an item in your vault, so it is encrypted like every password.
AI log
Every request appears in the AI log on your device: time, feature, destination, kind of data, size and outcome. The log does not store the content of the request. You can clear it at any time.