Skip to content
VaultKeepR

Get started with the browser extension

VaultKeepR for the browser is a local-first password manager. Your vault is encrypted on your device with XChaCha20-Poly1305 and Argon2id, and syncs as an encrypted blob over IPFS. There is no account and no email: your identity is a wallet signature handled on-device. This guide covers installation, vault creation and the features you use every day.

Install the extension

Section titled “Install the extension”

After installation, pin the VaultKeepR icon to your toolbar. The icon opens the popup, which is the main interface of the extension.

Create your vault

Section titled “Create your vault”
  1. Click the VaultKeepR icon. If no vault exists yet, the Create Vault screen appears.
  2. Choose a master password. It derives your encryption key with Argon2id on your device and never leaves it, so it cannot be reset: make it long and keep it safe.
  3. Optionally enroll a passkey (WebAuthn). It lets you unlock with your fingerprint, face or security key, and the PRF extension is used to protect the master password locally.
  4. No email address or username is ever requested.

A short onboarding tour then walks you through the popup: header with search, add and settings; the entry list; the detail pane; and the bottom navigation bar.

Unlock and auto-lock

Section titled “Unlock and auto-lock”

Enter your master password (or use the passkey) to unlock. While the vault is unlocked, decrypted entries live only in the browser session storage and are wiped when the vault locks or the service worker restarts. Auto-lock triggers after a configurable timeout, adjustable in the popup settings.

Fill a login form

Section titled “Fill a login form”
  • Focus the username or password field on a site’s login page. VaultKeepR detects the form and opens a selection overlay anchored to the field, listing the credentials that match the current site. Click one to fill.
  • If the entry has a TOTP secret, a 2FA mini-overlay appears after the fill: it shows the current 6-digit code, a circular countdown to the next code, and Fill and Copy buttons. The TOTP secret itself never leaves the background script; the page only receives the ephemeral code.
  • If the vault is locked, a “Vault locked” floater appears instead. Unlock from the popup, then focus the field again.
  • Multi-step logins are supported: on sites such as Google, the username you pick on the first page is suggested on the next one.
  • Overlays close automatically on Escape, on scroll (after a short grace period), when the tab loses visibility, and after 15 to 30 seconds.

Save and update credentials

Section titled “Save and update credentials”

When you submit a login form, a save prompt appears in the top-right corner:

  • Save stores the new credentials in your vault and shows a confirmation toast.
  • If the credentials match an existing entry, the prompt reads Update instead, so you confirm changes after a password reset.
  • Generate fills the password field with a fresh 20-character generated password before you submit.
  • Closing the prompt, clicking outside it, or letting it time out (30 seconds) resumes the form’s normal submission, so you never get stuck.

Signup, change-password and identity forms

Section titled “Signup, change-password and identity forms”
  • On a registration form, the signup overlay offers to fill all password fields with a generated password, or, as a Premium feature, to create an email alias and fill both the alias and the password.
  • On a change-password page (several password fields, no username field), the overlay can generate a new password, fill the current password from your vault, or fill from a matching vault entry.
  • On identity or address forms, an identity overlay fills your saved personal information (first name, last name, email). On card forms, a card overlay lists your saved bank cards with their brand logo; the CVV stays protected.

Right-click actions

Section titled “Right-click actions”

Right-click inside any input field on a page to find two context-menu entries: Autofill opens the credential selection for the current site, and Generate password inserts a strong generated password into the field.

Generator, TOTP and health tools

Section titled “Generator, TOTP and health tools”

Open the popup and use the tools in the header:

  • Generator: creates passwords with configurable length and symbols, with a strength meter (zxcvbn-based).
  • TOTP panel (Premium): your 2FA codes next to your passwords, always live.
  • Password health: flags weak, reused and old credentials.
  • Breach scanner: checks passwords against the HaveIBeenPwned Pwned Passwords API using k-anonymity. Only the first five characters of the locally computed SHA-1 hash are sent; the full hash and password are not sent. Matching the returned suffixes happens on device. Scanning your email addresses against breach databases uses leakcheck.io and requires your explicit consent before the first scan.

Sync over IPFS

Section titled “Sync over IPFS”

The popup’s vault panel manages encrypted replication to IPFS. No cloud account is required, and the extension works offline; sync resumes when you are back online. Your master password never leaves your device, so nobody can read your vault. Lost device recovery relies on a 3-of-5 Shamir secret sharing scheme.

Phishing protection and TOS analysis

Section titled “Phishing protection and TOS analysis”
  • VaultKeepR ships a local domain blocklist (MetaMask eth-phishing-detect data, refreshed at each release) and combines it with fuzzy hostname matching and in-page heuristics. If a login field on a suspicious domain is focused, a phishing alert banner is displayed and the autofill overlay is blocked; flagged domains are also blocked locally through declarativeNetRequest rules so the page cannot load.
  • When you open a site’s legal pages, an on-device AI model summarizes the Terms of Service and privacy policy and shows a small banner about data-sharing risk and account-deletion difficulty. The analysis runs locally in an offscreen document; no page content is sent to any server.

Security in daily use

Section titled “Security in daily use”
  • Copying a password clears the clipboard automatically after a short delay.
  • Decrypted entries never touch persistent local storage; only the encrypted blob does.
  • Export your vault anytime from the tools, in CSV or JSON, with no vendor lock-in.

Next steps

Section titled “Next steps”