Locking now signs the session out as well. Locking the vault — by the button or by the auto-lock timer — used to end it here and leave the session listed under Settings → Active sessions on the web for up to thirty days. If you unlock several times a day, that list filled up with sessions you could not identify and had not used since. It tells Nova now, so a lock removes the row. Locking still happens instantly whether or not that message gets through, and a session left behind another way — by quitting the browser, say — is cleared the next time you sign in.
Fixed: Settings opened the page behind whatever you were looking at. On Firefox, clicking Settings appeared to do nothing — and pressing Back afterwards revealed the settings page, which had been there all along. It now comes to the front. Most noticeable on Android, where the panel covers the screen.

Fixed: signing in with a saved login no longer asks you to update it. Filling a credential from Nova and then signing in prompted "update this login?" every time, for a password you had just taken out of the vault and put back unchanged. Nova now compares what was submitted against what it holds and says nothing when they match. A changed password still prompts, and so does an account it has never seen.
A login saved for one address is recognised across that site's other addresses. Signing in at login.example.com with a credential saved for example.com used to offer to save a second copy of it. It is the same site as far as filling is concerned, so it is now the same site as far as saving is concerned.

Fixed: the Settings button did nothing on Firefox. It opens the options page now. The button asked the browser to show the page in a way that Firefox could decline without reporting anything — no error, no message, nothing in the console — so the click looked ignored. Nova now opens the page itself, and focuses it if it is already open rather than adding another tab.

Click the mark in the login box and pick which login to fill.

The Nova mark is now a chooser. Click it and a short list appears beside the field, showing the logins saved for that site with the account and vault each one is in. Pick one and the form fills. Previously the mark told you credentials existed and the toolbar popup was the only way to use them.
It appears next to the field it fills, above or below depending on the room available, rather than in the corner of the window.
The list only ever holds logins saved for the site you are on, and a fill is re-checked against the item's own saved address before anything is written — so a page cannot be shown, or filled with, a credential belonging to somewhere else.
Filling from the chooser confirms it filled, the same as automatic filling does.


If the vault is locked, clicking the mark says so instead of showing an empty list.

You can now see that Nova is there.

A Nova mark appears in the login box, showing at a glance whether the vault is unlocked and how many saved logins it holds for the site you are on. Previously nothing on the page indicated the extension was installed at all.
The toolbar icon shows whether the vault is locked, and carries the number of logins saved for the current site. It used to look identical whether the vault was open, shut, or holding six credentials for the page in front of you.
Saving a new login is now offered on the page, in a small panel in the corner, instead of only as a + on the toolbar icon that was easy to never notice. It appears after you sign in — including after the page reloads, which is when you are actually looking — and it goes away on its own if you ignore it.
Signing in while the vault is locked now tells you it was not saved. Before, it did nothing at all: no prompt, no record, no way to tell that the offer had never existed. Nova still does not keep your password while it is locked, so the login genuinely is not saved — the change is that it says so instead of staying silent.
Autofill says when it has filled something, rather than leaving you to guess whether Nova did it or the site remembered.


Nova can sign in with a passkey, on the browsers that let an extension do it.
• Passkeys in the vault now work as passkeys. On Chrome and Edge, a site asking for a passkey can reach the one stored in your vault: Nova signs the challenge and the site logs you in. Every assertion asks you first, and names the site it is for — there is no setting that turns that confirmation off.
• Firefox and Safari store and share passkeys but do not sign with them, and the popup says so rather than looking empty. Those browsers offer no way for an extension to be the authenticator, and the alternative — replacing the browser's own passkey API from inside the page — would give up the one property a passkey has: that a page cannot mislead it about which site is asking.
• A passkey is matched to a site more strictly than a password is. A password saved for acme.com is offered on mail.acme.com, which is usually what you want. A passkey is not: it is offered only on the exact site it was created for, because being unusable on a lookalike domain is the whole point of one.
• A saved credential now carries a secret-scanning index when your organization has that switched on, so a leaked password can be recognised in a repository without the string ever being sent anywhere. Nothing changes for organizations that have not enabled it.
• Fixed: Settings showed a plain-HTTP warning to everyone. The acknowledgement about sending your key over an unencrypted connection was visible even on the default https:// address, where it did not apply. It appears only for a plain http:// server now, which is when it is true.
Still done in the Nova web app: changing an existing credential, and creating a passkey (Nova can use one it holds; enrolling a new one starts in the web app).

Nova can now save passwords, not just fill them.
• Save a login from the page. After you sign in to a site Nova does not know, it offers to save the credentials you just used. Nothing is stored unless you press Save, and dismissing the offer discards it.
• Optional automatic filling. Off by default. When enabled in Settings, Nova fills a sign-in form as soon as it appears — but only when exactly one saved item matches that exact address, never from a looser match, and never inside a frame belonging to another site. Left off, a credential only ever leaves your vault when you pick it.
• Works out of the box. New installs now point at Nova's hosted service instead of a local development address, so signing in works without visiting Settings first. Self-hosted deployments can still set their own address there.
• Firefox for Android is supported.
Still done in the Nova web app: changing an existing credential. If you save a login for a site you already have an item for, Nova will tell you rather than quietly storing a second copy.
Unchanged, and worth repeating: your keys are derived on your device and held in memory only, the vault locks on your own timeout, and Nova refuses to fill any item whose signature does not verify.