Make it easier to fill in the two-step verification code from your authenticator app.

For domains with an MFA code configured, the extension can now type the code into a login form, just like it fills in your password. When you open the popup on a login page, the MFA section shows an Inject button next to Copy. This also works with the split-up "one digit per box" code inputs many sites use; the code is distributed one character per box.

The code is even filled in automatically when you focus a field that clearly asks for one. Fields that declare themselves as one-time-code fields (autocomplete="one-time-code" or "otp") get the code injected on focus. Fields that merely look like a code field — such as a label or placeholder with "verification", "authenticator", or similar — open the popup with the code ready to copy or inject instead, so the extension never types into a field it is not sure about. Codes sent by SMS or email are deliberately left alone, since the extension can only work with codes it can reproduce on your own device.

This also covers two edge cases: a code field that was already focused when the extension was loaded into the page, and code fields sitting inside embedded frames — both get the same treatment.

Make it easier to load a configuration via the domain input field.

200ms after the last character entered, a background domain search will run to determine if a configuration exists for a variation of the current entered domain (adding typically used subdomain prefixes and TLDs).

If found, a suggestion is displayed that can be picked by pressing TAB.

This makes it easier to load configurations if you are unsure about the exact domain the configuration was generated for, e.g. when a website changed it's login (sub-) domain.

Because of the way configurations are stored (for security and privacy reason), this can in rare cases show false positives and display a domain (that often won't make sense) that you don't actually have a configuration for. This is not a bug or a signal you were hacked, just a side effect of the configuration storage mechanism.

Fix a UI regression in 1.5.0.

You were no longer able to create configurations for new domains.

TOTP secrets can now be saved per-domain to generate one-time passwords directly in the extension.

The feature is fully optional: if you don't configure a TOTP secret for a domain, nothing changes about the existing password derivation flow.

Because TOTP codes can't be derived from a master password, their secrets must be stored to disk; they are encrypted (XOR against the per-domain HKDF key) and are included in configuration backups, use of which will be recommended if you use this feature.