Browser extension

The extension talks to the Claspt app on your machine. The app must be running and unlocked for fills; the extension itself never holds your master password. This page covers extension 3.1 with desktop 4.1.

Install

Browser	Where
Chrome, Brave	Chrome Web Store (listing link added when live)
Edge	Edge Add-ons, or the Chrome version
Firefox	Firefox Add-ons (listing link added when live)
Safari	Not supported

For development or an air-gapped machine, load the unpacked build from chrome://extensions with Developer mode on.

Connect it

1. In Claspt: Settings › Integrations. Make sure Local API is on, then press Pair another browser.
2. In the extension’s popup, press Connect within two minutes.

That is the whole handshake; there is no token to copy. The extension gets a key of its own, listed under API Clients as “Browser extension on ”, which you can revoke there. Pair again after reinstalling the extension or moving to another browser. Pasting a key by hand remains as the fallback in the popup’s settings.

If the popup says the app does not know the extension’s key, pair again; if it says the app is not running, start Claspt.

Filling logins

• In the field. Login fields show a small Claspt icon. Click it, pick the account, and the fields fill. Your default account comes first, then the one you used last on that site.
• In the popup. The same accounts with copy buttons, and the two-factor code if the login has one.
• Several accounts on one site are normal; pick the one you mean, and mark one as the default from its menu.

Fills go only to the site the credential was saved for, over HTTPS; a mismatched domain or an insecure page gets a warning instead of a fill.

Every login you type is kept

When you submit a login or signup form, the login goes into the vault the moment you submit it, as a page tagged “captured”. A redirect, a code page, a lock or a crash cannot lose it. The bar at the top of the page then asks what to make of it, and comes back on every page of the site for an hour until you answer:

• Save keeps it as an ordinary login.
• Update appears only for the same account with a changed password, and touches that account only. A second account on the same site is offered Save as new, never Update.
• Never for this site stops the bar on that site.
• Close the bar and the login stays listed in the popup under waiting to be saved, with Save and Discard.

If the app is not running, the login is kept in the extension and written to the vault when the app is back. A password the site plainly rejects (the field marked invalid, or an alert that says so) is dropped rather than kept. If a login was already saved unchanged, nothing is asked.

Identities

The Identity tab holds your name, phone, address, city, state, postcode, country and organisation. Keep more than one, a home and a work one. On a checkout or signup form, click the field icon and pick which you; the form fills from the site’s own field hints first, then from labels. Only which identity you picked on a site is remembered, never the values. Identities do not fill payment cards.

Two-factor codes and passkeys

A login that holds a two-factor key shows the live code in the picker and the popup. On a site’s setup page the extension reads the QR code off the page, shows the code so you can check it against the site, and saves the key with one click. Passkeys can be created and used from the extension, with the desktop holding the key and approving each use. See Passkeys and two-factor codes.

The generator

The popup’s Generator tab makes passwords, passphrases, memorable passwords, PINs and UUIDs with the same options as the desktop, and every password it makes lands in the same history as the desktop’s, marked when used. The right-click menu drops a fresh password into any field.

What the toolbar icon tells you

Hover the icon: how many logins the vault holds for this site, and how many captured logins are waiting to be saved. When the app is not running, the vault is locked, the extension’s key was refused, or a permission is missing, the icon dims and the hover text says which and what to do. The in-page picker says the same instead of “no matching credentials”.

Settings in the popup

Excluded sites, fill on page load, the extension’s own auto-lock and lock on browser close, clipboard clearing, and the fallback field for a pasted key.

Security

• The extension’s prompts and pickers are isolated from the page they appear on (closed shadow roots, real-click detection); a page cannot read the usernames on offer or click the buttons for you.
• Site matching uses the full Public Suffix List, so shared hosts such as github.io do not treat every tenant as one site.
• A page’s content script may save or update only credentials for its own site, and may confirm or discard only captures made on that site.
• Every request carries the extension’s own key; revoke it in the app and the extension stops at once.
• Secret values are never logged by the extension, and its waiting-list holds no password: the capture is in the vault.

Shortcuts and platforms

Cmd+Shift+L (Ctrl+Shift+L) fills the current form; change it in the browser’s extension shortcuts if it collides with anything. The extension works the same on macOS, Windows and Linux; on Windows the first connection asks the firewall once, which Connection troubleshooting walks through.