Uzavik Vault

Uzavik Vault brings the logins already stored in your Uzavik Vault desktop app into Chrome, so you can fill a sign-in form without retyping a password or copying one through the clipboard. This extension is a companion, not a password manager on its own. It stores nothing. Every credential lives in the Uzavik Vault Windows application on your own PC, encrypted and locked to your VaultKey USB device. The extension asks that application for a single password, for a single site, at the moment you ask it to — and forgets it immediately afterwards. BEFORE YOU INSTALL You need all three of these. The extension cannot work without them: • Windows 10 or Windows 11 • The Uzavik Vault desktop application, installed and running • Your Uzavik VaultKey USB device, plugged in If any of these is missing, the extension will tell you which one and do nothing else. There is no cloud fallback, no online account, and no way to sign in from a browser alone. That is deliberate. WHAT YOU CAN DO Fill a saved login Open a sign-in page, click the Uzavik Vault icon, and the Logins tab lists the logins saved for that exact site. Click one and the username and password go straight into the page's fields. The form is never submitted for you — you review what was filled and press the site's own sign-in button yourself. Choose between multiple accounts Plenty of people keep a work account and a personal account on the same site. Every matching login is listed with its real username so you can tell them apart at a glance, and a search box above the list narrows it as you type. Save a login as you sign in Type your username and password into a site's sign-in or sign-up form as usual, then click the extension and open the Add tab. The form opens already filled in from what you typed on the page, so you only check it and press Save. If a login for that site already exists, the extension offers to update it instead of creating a duplicate. The Add tab is available only on a page that actually has a login field. Add or correct a login by hand The same form works when there is nothing to read — a sign-in split across several pages, or a password you were given elsewhere. Type the username, password and an optional note, and it saves against the site you are currently on and fills the page for you. Keep secret notes with a login Recovery codes, backup PINs, security question answers and account numbers can be stored alongside the password. Notes are treated as a secret, not as a label: they are never shown in any list and never travel with an ordinary fill. You see a note only when you explicitly ask to reveal that one login's note, and an ordinary password update never overwrites a note you wrote in the desktop app. Generate a strong password The Generator tab produces passwords from 8 to 128 characters using a cryptographically secure random source with unbiased sampling. You choose which character types to include, can set a minimum number of digits and symbols for sites that demand them, and can add a fixed prefix or suffix. Easily confused characters — l, I, O, 0 and 1 — are left out by default so a password stays readable if you ever have to type it on a phone or read it aloud. Generation happens entirely inside the browser; the generator never contacts your vault or anything else. Fill a generated password straight into a field When a site asks you to choose a new password, right-click the password box and choose "Fill a generated password", or press Alt+Shift+P. A strong password is generated and typed into the box — and into the confirmation box, if the form has one — without opening the popup. Then save the login from the Add tab. HOW IT IS BUILT It only runs when you ask it to There are no content scripts and no site permissions. The extension is not loaded into the pages you visit, does not watch you type, and does not sit in the background scanning forms. It touches a page only in the moment you invoke it — by clicking the toolbar icon, choosing its right-click menu item, or pressing its keyboard shortcut — using Chrome's activeTab permission, and only for that one tab. Browsing with the extension installed but unused is indistinguishable from browsing without it. Your desktop app decides, the extension only asks The browser side has no authority. It cannot decide that a site matches a credential, cannot decide whether the vault is unlocked, and cannot decide that a password may be released. Each request is re-checked by the desktop application, which holds the encryption keys and the matching rules. If the vault is locked, or the VaultKey is unplugged, or the site does not match, the answer is simply no — there is nothing in the browser to talk around. Your passphrase never enters the browser The extension has no passphrase field and cannot pass one to your vault. You unlock in the Uzavik Vault desktop app. On a PC you have already marked as trusted in the desktop app, the popup can also offer "Unlock with this device", which asks the desktop app to use that PC's own protection — no passphrase or recovery key is sent from the browser. Site matching is strict, because phishing is the real threat A password is offered only over HTTPS and only to an exact origin match. A page that merely looks like your bank, or lives on a similar-looking domain, gets nothing. If a login form is inside an embedded frame, the extension fills it only when that frame's own origin is the same as the page's — a frame from somewhere else is skipped, which is the pattern behind a number of credential-stealing techniques. Each fill is authorised once Permission to read a specific password is single-use and short-lived. It is granted only by a search you initiated for the site you are actually on, it expires within seconds if you do not act, and it is consumed the moment it is used. Locking your vault, unplugging the VaultKey or closing the browser invalidates everything immediately. The channel to your vault is encryp…