Autofill

Passbox compares the page's address with the websites in your logins. What counts is the domain: a login for example.com also matches login.example.com. Two different customers of a host such as name1.github.io and name2.github.io do not match each other.

So save the website with every login. Without it, Passbox cannot suggest anything. The security check lists logins without a website.

In Android apps, the link to the app and its signing certificate counts. More in Android.

Passbox never fills in on its own, only after an action of yours. In addition:

• Lookalike addresses: If a page looks like a saved or well-known website but is not (for example paypa1.com instead of paypal.com), Passbox warns "Careful: this is not paypal.com" and fills in nothing.
• Unsecured connection: On pages with http instead of https, Passbox asks first. The same applies if a login saved for https would end up on an http page.
• Foreign frames: If a form sits in an embedded frame of another website, Passbox asks before filling it in.
• Invisible fields: Passbox fills only visible fields. If a form has no visible password field, Passbox fills in the username only.
• No match: If you pick a login on your phone that does not belong to the app or website, Passbox asks first.

When you sign up on a website or change a password with the browser extension, Passbox offers to save it or to update the existing login. The old password stays under Previous passwords.

When you sign up, the extension suggests a strong password in the password field.

If a login has a 2FA code, the browser extension fills it into the next step of the sign-in when you pick it. On Android, Passbox fills in the password and copies the code to the clipboard. On iPhone, copy the code from the app.

Passbox clears copied passwords from the clipboard after a time you can set, and when it locks. On phones, copied values stay for 90 seconds. The desktop app also keeps passwords out of clipboard history.