+++
title = "Autofill"
date = 2026-11-05T00:00:00Z
description = "How to turn on HardenedPass autofill, fill logins in apps and browsers, save new ones, and what the phishing warning means."
weight = 80
draft = false
+++

Autofill offers your entries directly in login forms, in apps and in browsers, so you do
not need to copy anything.

## Turn it on

Open **Settings**, then **Autofill**, and turn on **Enable Autofill**. The app explains what will happen and
lists your installed browsers with how well each one is supported. Tap OK, choose
HardenedPass in Android's autofill settings and confirm.

## What each browser can do

The app only trusts browsers it knows, because a browser has to report honestly which
site a form belongs to. A browser that is not on the list gets no autofill at all.

| Support level | Meaning | Examples |
|---|---|---|
| **Fill and save credentials** | Fills username and password, offers to save new ones | Firefox |
| **Fill and save passwords** | Same, but saving needs no accessibility services enabled | Chrome, Cromite |
| **Fill credentials** | Fills username and password, no saving | Tor Browser |
| **Fill passwords** | Fills the password only | Vanadium |
| **No support** | Autofill stays off | Any browser not on the list |

Vanadium, the browser that comes with GrapheneOS, is trusted, but only at the
**Fill passwords** level. For full support on GrapheneOS, use Firefox. The dialog in
Settings shows the real level for the browsers on your phone.

## Fill a login

Tap a login field. Depending on your keyboard, suggestions appear as chips in the
keyboard's bar or as a dropdown under the field:

- An entry already linked to this site or app shows up by name. Tap it, unlock with
  your passphrase and the form is filled.
- **Search entry** opens a search over your store. The entry you choose stays linked
  to this site or app, so next time it shows up directly.
- On forms that ask for a new password, such as sign-up pages, **Create entry** opens
  the editor to make one for this login.

## Save a new login

In a browser that supports saving, log in as usual. Android offers to save to
HardenedPass. Tap **Save** and the app opens its editor, with the username and password
filled in. Save the entry there, then remember to
[sync]({{< relref "/hardenedpass/using/sync" >}}).

Firefox also shows its own save prompt. That one is Firefox's password manager, not
HardenedPass, and you can dismiss it. To stop it for good, turn off saving passwords in
Firefox's settings: only the HardenedPass prompt remains.

## Apps that use Android's password manager

Some apps skip the login form and talk to Android's password manager directly, for
example Signal when it offers to store its backup key. On Android 14 and later,
HardenedPass answers those requests too.

Open Android's **Settings**, then **Passwords, passkeys & accounts**, and check that
HardenedPass is turned on there. Being the preferred autofill service is not enough: an
app that finds no password manager enabled says so and offers to open these settings.

- **Saving:** when the app offers to store a password, choose HardenedPass in the sheet
  Android shows. The editor opens with the password filled in. Save the entry there and
  it stays linked to that app.
- **Filling:** when the app asks for a password, the sheet lists the entries linked to
  it. Pick one and unlock with your passphrase. **Search entry** finds any other entry,
  and links it for next time.

Browsers keep using autofill for websites, as described above.

## The phishing warning

Fill suggestions are tied to the app that requested them. If an app you linked to an
entry changes publisher, its signing certificate no longer matches, and you see
**Possible phishing attempt** instead of your entry. Tap it for the details.

The app may have changed hands legitimately, but it may also be a fake installed in
place of the real one, trying to get your password. **Keep Autofill disabled** is the
safe answer. Choose **Re-enable Autofill** only if you know why the publisher changed.