Documentation
On this page
Autofill
Autofill offers your entries directly in login forms, in apps and in browsers, so you do not need to copy anything.
Turn it on
Open Settings, then Autofill, and turn on Enable Autofill. The app explains what will happen and lists your installed browsers with how well each one is supported. Tap OK, choose HardenedPass in Android’s autofill settings and confirm.
What each browser can do
The app only trusts browsers it knows, because a browser has to report honestly which site a form belongs to. A browser that is not on the list gets no autofill at all.
| Support level | Meaning | Examples |
|---|---|---|
| Fill and save credentials | Fills username and password, offers to save new ones | Firefox |
| Fill and save passwords | Same, but saving needs no accessibility services enabled | Chrome, Cromite |
| Fill credentials | Fills username and password, no saving | Tor Browser |
| Fill passwords | Fills the password only | Vanadium |
| No support | Autofill stays off | Any browser not on the list |
Vanadium, the browser that comes with GrapheneOS, is trusted, but only at the Fill passwords level. For full support on GrapheneOS, use Firefox. The dialog in Settings shows the real level for the browsers on your phone.
Fill a login
Tap a login field. Depending on your keyboard, suggestions appear as chips in the keyboard’s bar or as a dropdown under the field:
- An entry already linked to this site or app shows up by name. Tap it, unlock with your passphrase and the form is filled.
- Search entry opens a search over your store. The entry you choose stays linked to this site or app, so next time it shows up directly.
- On forms that ask for a new password, such as sign-up pages, Create entry opens the editor to make one for this login.
Save a new login
In a browser that supports saving, log in as usual. Android offers to save to HardenedPass. Tap Save and the app opens its editor, with the username and password filled in. Save the entry there, then remember to sync.
Firefox also shows its own save prompt. That one is Firefox’s password manager, not HardenedPass, and you can dismiss it. To stop it for good, turn off saving passwords in Firefox’s settings: only the HardenedPass prompt remains.
The phishing warning
Fill suggestions are tied to the app that requested them. If an app you linked to an entry changes publisher, its signing certificate no longer matches, and you see Possible phishing attempt instead of your entry. Tap it for the details.
The app may have changed hands legitimately, but it may also be a fake installed in place of the real one, trying to get your password. Keep Autofill disabled is the safe answer. Choose Re-enable Autofill only if you know why the publisher changed.