Password vault

The Passwords tab is a local password vault. It lives entirely on your device — credentials are never sent to Teleperson or any other server, and they never leave your browser unless you explicitly export an encrypted backup.

What you see

Open the side panel and click Passwords in the left rail. The first time you open it, you'll be asked to set a master password.

• Set master password. This password encrypts every credential. It's never stored, never sent anywhere, and cannot be recovered if forgotten — treat it as the single key to everything saved here.
• Saved credentials list. Each entry shows a label, the site origin, and a "Fill" button when the active tab matches.
• Search. Filter by label or site host.
• Add credential. Click the + icon. The editor asks for a site URL (e.g. https://bestbuy.com), a label, the username, and the password.
• Lock now. The lock icon in the header drops the in-memory key immediately. The same happens automatically after inactivity.

Saving a credential

Click + in the Passwords tab. Enter:

• Site origin — the canonical scheme + host of the login page (e.g. https://example.com). The vault matches origins exactly: https://x is not the same as http://x, and a different port doesn't match either.
• Label — a friendly name shown in the list. Defaults to the site host.
• Username and password.
• Notes (optional).

Click Save. The entry is encrypted with AES-256-GCM and stored in your browser's local extension storage.

Filling on a page

When you visit a login page on a site you have credentials for:

1. Open the Teleperson side panel and switch to the Passwords tab.
2. A pill at the top of the list shows the active site, with a "login form" badge if a username/password form was detected. If exactly one of your saved entries matches the site, a Fill on this page button appears.
3. Click Fill. The extension verifies inside the background service worker that the active tab's top-frame origin still matches the entry, then pushes the credentials into the page's username and password fields.
4. The fill only ever targets the top frame. Cross-origin iframes never receive credentials, even if they contain a login form.

You can also fill from the Saved credentials card on the Overview tab — the card shows the credentials saved for the company you're currently viewing (matched against the company's domains[] list).

Auto-lock

The vault locks on its own:

• After inactivity. Default 5 minutes; configurable in the future.
• On browser restart. Reopening the browser leaves the vault locked — the master password is needed to unlock it again.
• Manually. Click the lock icon at the top of the Passwords tab.

When locked, your saved entries remain encrypted on disk and cannot be read without the master password.

Saved credentials on the Overview tab

When you're viewing a company's Overview tab and that company has matching credentials in your vault, a Saved credentials for [Company] card appears. It lists every entry whose origin matches one of the company's domains. From here you can also fill the credential on the active tab if the page origin matches.

If no credentials are saved for the company yet, the card shows a quick link to the Passwords tab so you can add one.

Changing your master password

In the Passwords tab, open the settings menu and choose Change master password. You'll be asked for the current password and the new one. The vault is re-keyed in place — no entry is re-encrypted, only the wrapping key on top of the per-entry ciphertext changes.

Encrypted backup

In the Passwords tab settings menu, choose Encrypted backup… to:

• Export — re-enter your master password, then download a JSON file containing the full encrypted vault. The file is the same AEAD ciphertext that lives on disk; nothing inside it is recoverable without your master password.
• Import — paste the contents of a previous export. You'll be asked for the master password the export was made with. Importing replaces any vault currently on this device.

Keep the backup file and your master password in different places — losing either makes the other useless.

Privacy and security

• The master password never leaves your device. Teleperson cannot help you recover it.
• All credentials are encrypted on disk with AES-256-GCM. The encryption key is itself encrypted under a key derived from your master password with PBKDF2-SHA-512 at 600,000 iterations.
• The background service worker is the only piece of the extension that ever holds the decryption key in memory, and it does so only while the vault is unlocked.
• Autofill only happens after a click in the panel — there is no silent fill on page load, ever.
• The extension never auto-fills into iframes whose top frame is a different origin, and it never sends credentials to the page based on what the page itself reports about its origin.

When it's available

The Passwords tab is available in any panel session. It does not require sign-in to the Teleperson backend — the vault is local-only.

Out of scope (today)

• Cloud sync between devices.
• Hardware-backed unlock (e.g. WebAuthn / passkeys).
• Sharing credentials with another user.
• TOTP / one-time-code storage.
• Breach monitoring.

Related

• Overview tab — where the per-company credentials card lives.
• Auto-detection — how the extension recognizes which company a tab belongs to (the same domain match used to scope vault entries on the Overview tab).