ZPassword Browser Extension v1.3.1

ZPassword

Download	zsync.eu/zpassword-extension
Source	github.com/TheHolyOneZ/ZPassword-Extension
Author	TheHolyOneZ
More projects	zsync.eu

A browser extension that solves one annoyance: you need a fresh password, so you
go find a generator page, and then nothing about that moment is remembered — not
the rules you picked, not the password itself.

ZPassword opens with a password already generated, keeps your rules per site, and
puts the password into the page for you.

• A password is ready the instant you open it. No button to press first,
  and it is colour-coded so you can read it back or type it by hand.
• Or already in the page. Turn on auto-fill and the box is filled before you
  have looked at it — without the popup closing on you.
• Your settings stick. Every control saves itself the moment you touch it.
• Pick the exact characters. Not just "symbols on" — double-click a kind and
  switch individual characters on or off, letter by letter.
• Everything is per-site. The site that caps you at 16 characters, bans #,
  and needs filling the moment you arrive gets its own rules; everywhere else
  keeps your defaults.
• One-click fill. Handles the new-password and confirm-password box, leaves
  the current-password box alone, and works inside iframes and shadow DOM.
• Encrypted history. Passwords you actually copy or fill are saved, sealed
  with a passphrase only you know, so you can get one back later — searchable,
  annotatable, and backed up to a file that stays encrypted.
• Nothing leaves your machine. No network code, no accounts, no telemetry.

---

Install

Grab a ready-made zip from
zsync.eu/zpassword-extension, or build
it yourself from source — see Building.

Chrome, Edge, Brave, Vivaldi, Opera

1. Build the zips, or just use this folder directly.
2. Open chrome://extensions (edge://, brave://, vivaldi://… same page).
3. Turn on Developer mode, top right.
4. Load unpacked → pick this folder.
   (To install from a zip instead: unzip dist/zpassword-chromium-1.3.1.zip
   first, then load that folder — browsers will not load a zip directly.)
5. Pin ZPassword to the toolbar so it is one click away.

Firefox

Firefox 115 or newer. (Module background scripts landed in 112; the binding
constraint is storage.session, which shipped in 115.)

1. Build to produce dist/zpassword-firefox-<version>.zip.
2. Open about:debugging#/runtime/this-firefox.
3. Load Temporary Add-on… → pick the zip.

Firefox removes temporary add-ons when it restarts. For a permanent install the
add-on has to be signed by Mozilla — free, at
addons.mozilla.org → submit → "on your
own" for a self-distributed signed copy.

Shortcuts (Cmd instead of Ctrl on Mac):

Ctrl+Shift+Y	Open ZPassword
Ctrl+Shift+L	Generate and fill the page without opening it

Rebind either at chrome://extensions/shortcuts.

Settings also has Open ZPassword in a full tab, which is the same interface
without the 384px squeeze — it is registered as the extension's options page, so
chrome://extensions reaches it too.

---

Using it

Generate — a password is already there. R or the ↻ button makes
another. Click the password itself to copy it.

Choosing characters — the four buttons (A–Z, a–z, 0–9, !#$) switch a
whole kind on and off. Double-click one — or press the ⋯ in its corner —
to open the picker and switch characters on and off individually. Each button
shows how many are in use, so 25/26 tells you at a glance that something is
switched off in there.

Inside the picker: All, None, and Reset (back to the shipped
default). Characters held off by Exclude look-alikes show with a dashed
border; clicking one turns that shortcut into plain per-character choices and
gives you the character you reached for, rather than doing nothing.

Symbols start with " ' \ \ | ~` switched off, since those are the ones that
tend to get mangled by shells, CSV exports, and sloppy signup forms. Switch them
back on in the picker if you want them.

Fill on page — writes into the password boxes of the current tab and closes.
If you click into a specific box first, only that box gets filled.

Pin these here — the button at the bottom of the Generate tab. Freezes the
current rules for the site you are on. Everything you change while a site is
pinned — character rules and the on-open behaviour in Settings — saves to that
site instead of your defaults.

Right-click any text box on a page → Fill with a new password. Generates
and fills without opening the popup at all; a ✓ badge confirms.

Recent — the passwords you copied or filled, newest first. Reveal, copy,
re-fill, annotate, or delete each one. Past five entries a search box appears,
matching on site and note. The Generate tab tells you when you already have a
saved password for the site you are on, so you do not make a second one by
accident.

Sites — every site that has rules of its own, what those rules are, and the
three on-open switches for each. Remove one site's rules, or all of them.

---

Filling the moment it opens

Settings → Fill the password into the page straight away. From then on, opening
ZPassword on that site puts a fresh password into the box immediately.

The popup deliberately stays open when this happens — you still get to look
at the password, regenerate if you do not like it (which re-fills the page), copy
it, or change the rules. Only the explicit Fill on page button closes the
popup, because that is you saying you are done.

Repeated auto-fills do not pile up in the history: the entry is replaced each
time, so you end up with the password you actually kept, not a log of every
attempt. The moment you press Copy, that password is treated as committed and
stops being replaced.

Because this setting lives on the profile, it is per-site: auto-fill on the two
sites where you want it, and nowhere else.

---

Global settings versus per-site settings

The header on the Settings tab always tells you which one you are editing:

• Not pinned → "These are your defaults."
• Pinned → "These apply to github.com only. Your defaults are untouched."

Per-site: everything about how the password is built (length, kinds, individual
characters, the Advanced switches) plus the three on-open behaviours (fill, copy,
save history).

Always global: how long saved passwords are kept, and how long the vault stays
unlocked. Those describe the one shared vault, so per-site copies would not mean
anything.

---

About the encrypted history

Only passwords you use are saved. Idly hitting regenerate twenty times does not
fill the list — an entry is written when you copy or fill.

The encryption is arranged so that saving never interrupts you:

• On setup, a P-256 key pair is created. The public key is stored in the
  clear, so the extension can encrypt a new entry at any moment without asking
  for your passphrase.
• The private key is sealed with AES-256-GCM under a key derived from your
  passphrase (PBKDF2-SHA-256, 600,000 iterations). Reading history means
  unsealing it.
• Each entry gets its own ephemeral key pair, so two identical passwords produce
  completely different ciphertext.
• While unlocked, the private key sits in storage.session — memory only, never
  written to disk, gone when the browser closes. It also auto-locks on the timer
  you set in Settings.

ZPassword refuses a passphrase it can see through. The meter scores a multi-word
phrase by words rather than by characters — the character model would credit
"correct horse battery staple" with about 130 bits when a word-list attack needs
far less, and an optimistic number here would be the most misleading thing in
the extension. Four unrelated words is the floor.

There is no recovery. A wrong passphrase is indistinguishable from a
corrupted entry, by design. If you forget it, the only way forward is Settings →
erase saved history, which deletes the entries permanently. Back up first
(Settings → Back up…): the file is the sealed vault exactly as stored, so it is
no weaker than what is already on your disk, and it is the only protection
against losing a browser profile.

Two further protections, both aimed at someone who can write to your extension
storage rather than merely read it:

• The stored public key is authenticated with an HMAC under your passphrase. Without
  that, an attacker could swap in their own public key and silently receive every
  password generated from then on; now unlocking refuses and says so.
• Each entry binds its id and timestamp as AES-GCM additional authenticated
  data, so stored metadata cannot be reshuffled underneath the ciphertext.

Entries this key cannot open are counted and reported rather than quietly
skipped — silently hiding them would hide exactly the attack above.

What this protects against: someone reading your browser profile off disk, a
backup, or a synced copy. What it does not protect against: someone at your
unlocked c...