Remote Fill

Remote Fill lets you keep your digital vault on one device and deliver selected values without synchronizing the full collection to every computer you use. EVERY SYNCHRONIZED VAULT EXPANDS YOUR SECURITY BOUNDARY The risks are familiar: unattended sessions, compromised device credentials, remote administration, theft, and endpoint compromise. Securing each device helps, but it does not change the underlying exposure—the vault has been duplicated. SELECTIVE, ENCRYPTED DELIVERY Choose one editable field and open Remote Fill. Scan the one-time QR code nearby, or share its short-lived link with the person you intend to receive from remotely. Both represent the same invitation and compete for the same first successful claim. The selected value is delivered without giving the destination a synchronized vault or continuing access to everything inside it. SECURITY MODEL • Every transfer creates fresh, ephemeral P-256 ECDH endpoint keys. • HKDF-SHA-256 derives a transfer-specific content key, and AES-256-GCM encrypts and authenticates the value. • Encryption occurs in the sending browser before transmission. Authenticated decryption occurs only inside the extension. • The relay carries an opaque encrypted envelope. Its accepted data path has no endpoint private key, content key, plaintext, or content-decryption operation. • Destination origin and field type stay inside the authenticated endpoint context instead of the relay payload. • Authenticated context binds the protocol version, route, destination origin, field type, challenge, expiration, and delivery path. Substitution or ciphertext tampering fails authentication. • Each invitation accepts one sending-device claim, each encrypted envelope can be consumed once, replay is rejected, and unfinished transfers expire after two minutes. • A remote share link wraps that same invitation to a sender's fresh ephemeral P-256 key. Its readable XXXX-XXXX code does not create a second transfer or expose the invitation to the relay in plaintext. • Remote Fill intentionally keeps no transferred-value history. The short-lived relay retains only capability hashes and the opaque envelope needed to complete or reject that transfer. TRUST BOUNDARY The relay and network are not trusted with content confidentiality. The sending browser and extension are the encryption endpoints. The extension activates only after you invoke it for one editable field, inserts the result without submitting the destination form, and uses no Remote Fill account, synchronized clipboard, advertising, or analytics. LOCAL PASSWORD GENERATOR The toolbar popup can create a Simple, Memorable, or Complex password locally and insert it directly into the one supported field that was focused when the popup opened. The same three presets are available under Remote Fill → Generate and fill when the user right-clicks an editable field. Generation uses browser cryptographic randomness and an embedded word list. These generators never read from or write to the clipboard and never invoke copy or paste. The generated value is not sent to the Remote Fill relay or persisted in extension or browser storage. A value generated in the popup remains visible only until the user clears it or the popup closes; a right-click preset is inserted immediately and retained only by the destination page. After insertion, the destination page can read it and its own submit/save flow may prompt an installed password manager to save it. After insertion, the destination page can read the value. Compromised endpoints, hostile destination pages, keyloggers, screen capture, and maliciously replaced sending-page code are outside the confidentiality boundary. The protocol uses standard, release-tested cryptographic constructions. This does not claim that the browser or runtime cryptographic modules are FIPS validated, that the service is FedRAMP authorized, or that an independent security assessment has been completed. The exact code-level claims and validation status are published at https://remotefill.com/support.