1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
|
+++
title = "Autofill"
date = 2026-11-05T00:00:00Z
description = "How to turn on HardenedPass autofill, fill logins in apps and browsers, save new ones, and what the phishing warning means."
weight = 80
draft = false
+++
Autofill offers your entries directly in login forms, in apps and in browsers, so you do
not need to copy anything.
## Turn it on
Open **Settings**, then **Autofill**, and turn on **Enable Autofill**. The app explains what will happen and
lists your installed browsers with how well each one is supported. Tap OK, choose
HardenedPass in Android's autofill settings and confirm.
## What each browser can do
The app only trusts browsers it knows, because a browser has to report honestly which
site a form belongs to. A browser that is not on the list gets no autofill at all.
| Support level | Meaning | Examples |
|---|---|---|
| **Fill and save credentials** | Fills username and password, offers to save new ones | Firefox |
| **Fill and save passwords** | Same, but saving needs no accessibility services enabled | Chrome, Cromite |
| **Fill credentials** | Fills username and password, no saving | Tor Browser |
| **Fill passwords** | Fills the password only | Vanadium |
| **No support** | Autofill stays off | Any browser not on the list |
Vanadium, the browser that comes with GrapheneOS, is trusted, but only at the
**Fill passwords** level. For full support on GrapheneOS, use Firefox. The dialog in
Settings shows the real level for the browsers on your phone.
## Fill a login
Tap a login field. Depending on your keyboard, suggestions appear as chips in the
keyboard's bar or as a dropdown under the field:
- An entry already linked to this site or app shows up by name. Tap it, unlock with
your passphrase and the form is filled.
- **Search entry** opens a search over your store. The entry you choose stays linked
to this site or app, so next time it shows up directly.
- On forms that ask for a new password, such as sign-up pages, **Create entry** opens
the editor to make one for this login.
## Save a new login
In a browser that supports saving, log in as usual. Android offers to save to
HardenedPass. Tap **Save** and the app opens its editor, with the username and password
filled in. Save the entry there, then remember to
[sync]({{< relref "/hardenedpass/using/sync" >}}).
Firefox also shows its own save prompt. That one is Firefox's password manager, not
HardenedPass, and you can dismiss it. To stop it for good, turn off saving passwords in
Firefox's settings: only the HardenedPass prompt remains.
## Apps that use Android's password manager
Some apps skip the login form and talk to Android's password manager directly, for
example Signal when it offers to store its backup key. On Android 14 and later,
HardenedPass answers those requests too.
Open Android's **Settings**, then **Passwords, passkeys & accounts**, and check that
HardenedPass is turned on there. Being the preferred autofill service is not enough: an
app that finds no password manager enabled says so and offers to open these settings.
- **Saving:** when the app offers to store a password, choose HardenedPass in the sheet
Android shows. The editor opens with the password filled in. Save the entry there and
it stays linked to that app.
- **Filling:** when the app asks for a password, the sheet lists the entries linked to
it. Pick one and unlock with your passphrase. **Search entry** finds any other entry,
and links it for next time.
Browsers keep using autofill for websites, as described above.
## The phishing warning
Fill suggestions are tied to the app that requested them. If an app you linked to an
entry changes publisher, its signing certificate no longer matches, and you see
**Possible phishing attempt** instead of your entry. Tap it for the details.
The app may have changed hands legitimately, but it may also be a fake installed in
place of the real one, trying to get your password. **Keep Autofill disabled** is the
safe answer. Choose **Re-enable Autofill** only if you know why the publisher changed.
|
