content: write HardenedPass using pages

Entries, OTP codes, sync with conflict recovery and autofill, in both
languages, with screenshots from the test store. Still drafts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 56 insertions, 4 deletions

diff --git a/content/en/hardenedpass/using/autofill/index.md b/content/en/hardenedpass/using/autofill/index.md
index 5a62cd1..43b7855 100644
--- a/content/en/hardenedpass/using/autofill/index.md
+++ b/content/en/hardenedpass/using/autofill/index.md
@@ -1,13 +1,65 @@
 +++
 title = "Autofill"
 date = 2026-11-05T00:00:00Z
-description = ""
+description = "How to turn on HardenedPass autofill, fill logins in apps and browsers, save new ones, and what the phishing warning means."
 weight = 80
 draft = true
 +++
 
-Placeholder.
+Autofill offers your entries directly in login forms, in apps and in browsers, so you do
+not need to copy anything.
 
-## First heading
+## Turn it on
 
-Text.
+Open **Settings** and turn on **Enable Autofill**. The app explains what will happen and
+lists your installed browsers with how well each one is supported. Tap OK, choose
+HardenedPass in Android's autofill settings and confirm.
+
+## What each browser can do
+
+The app only trusts browsers it knows, because a browser has to report honestly which
+site a form belongs to. A browser that is not on the list gets no autofill at all.
+
+| Support level | Meaning | Examples |
+|---|---|---|
+| **Fill and save credentials** | Fills username and password, offers to save new ones | Firefox |
+| **Fill and save passwords** | Same, but saving needs no accessibility services enabled | Chrome, Cromite |
+| **Fill credentials** | Fills username and password, no saving | Tor Browser |
+| **Fill passwords** | Fills the password only | Vanadium |
+| **No support** | Autofill stays off | Any browser not on the list |
+
+Vanadium, the browser that comes with GrapheneOS, is trusted, but only at the
+**Fill passwords** level. For full support on GrapheneOS, use Firefox. The dialog in
+Settings shows the real level for the browsers on your phone.
+
+## Fill a login
+
+Tap a login field. Depending on your keyboard, suggestions appear as chips in the
+keyboard's bar or as a dropdown under the field:
+
+- An entry already linked to this site or app shows up by name. Tap it, unlock with
+  your passphrase and the form is filled.
+- **Search entry** opens a search over your store. The entry you choose stays linked
+  to this site or app, so next time it shows up directly.
+- On forms that ask for a new password, such as sign-up pages, **Create entry** opens
+  the editor to make one for this login.
+
+## Save a new login
+
+In a browser that supports saving, log in as usual. Android offers to save to
+HardenedPass. Tap **Save** and the app opens its editor, with the username and password
+filled in. Save the entry there, then remember to
+[sync]({{< relref "/hardenedpass/using/sync" >}}).
+
+Firefox also shows its own save prompt. That one is Firefox's password manager, not
+HardenedPass, and you can dismiss it.
+
+## The phishing warning
+
+Fill suggestions are tied to the app that requested them. If an app you linked to an
+entry changes publisher, its signing certificate no longer matches, and you see
+**Possible phishing attempt** instead of your entry. Tap it for the details.
+
+The app may have changed hands legitimately, but it may also be a fake installed in
+place of the real one, trying to get your password. **Keep Autofill disabled** is the
+safe answer. Choose **Re-enable Autofill** only if you know why the publisher changed.