Wala pa ang pahinang ito sa inyong wika. Binabasa ninyo ang tekstong Ingles.
Sign-in details
Sign-in details beside the profile
- Login, password, page, note
- What a profile holds
- Never
- Sent to our server
- Sealed by the system on Windows only
- On disk
- The built in engine
- Filling into a window
Four fields on the profile
Twenty accounts are twenty rows in a sheet that lives somewhere else, and walking over to it is the slowest part of the day. Here the pair sits on the profile that uses it, beside its one time code key.
A profile with something saved wears a small mark on its card in the list, so you can see which accounts still live in the spreadsheet.
Login
The name, the mail address or the phone the account answers to. A line break never makes it in: it breaks the form and the row alike.
Password
Kept exactly as typed, spaces at the edges included. Tidying those away is a silent way to break a sign in.
Sign-in page
The address you go to. It has to start with http or https, or you get a refusal as you save.
Note
The half sentence with nowhere else to live: the recovery mail, the seller, the day it was bought.
Who gets the password
The list of profiles arrives without it. What reaches your screen is the fact that a password exists, not the password.
The value itself comes down on a request of its own, and only when you press show or copy. A fill never brings it to your screen at all: the app takes it and types it straight into the page.
An empty password box means leave it alone. Once you have loaded the real password into it, clearing the box drops the password and keeps the login.
Filling the open window
The app clicks into the field and types the value key by key like a person, clearing old text first with the usual shortcut.
The password lands in the field the form calls the password, not the first one. A sign-up form above the sign-in form keeps its own fields, and so does the search box at the top.
A profile launched without a window is filled the same way, and it is never pulled onto the screen.
- A page with search, a sign-up form and a sign-in form
- The sign-in fields, not search or sign-up
- A page with a search box and no sign-in form
- Nothing picked, written or sent
Both pages ran in a real browser window, and the search box stayed empty with no suggestion sent. The whole app filled our own test page and a same site frame in it: the page saw only real key presses.
Honest refusals
A button that does nothing is worse than a button that says why. Each refusal below names its own reason on screen.
ARMANOS Browser is open
You can only fill a window the app draws itself, and this one is drawn by a separate process. The refusal says so and points you at copying.
The profile is closed
There is no window to fill, so the app asks you to open the profile first.
Nothing is saved
This profile has no pair yet, and the app says so instead of reporting a fill of nothing.
No sign-in form
The profile window holds no sign-in form the app recognises, and its fields are left alone.
Where the pair is kept
On Windows the password does not lie in the profile file as text: the system seals it with a key tied to your Windows account. On macOS it is sealed with a key that ships inside the program, and on Linux it lies in the file as typed, so on both it does not protect against anyone who can read your user folder.
A key that ships inside a program is not a key, because everyone who downloads the program has it. The macOS seal rests on exactly such a key.
A value that will not open is not a lost one
What travels and what stays
While you are signed in, profile settings are mirrored through your account: name, group, scenario, fingerprint template, proxy, tags and notes. The pair is not among them, and there is simply nowhere on the server to write it.
Two roads take it off this machine, and you open both on purpose.
| Road off this machine | Does the pair travel? |
|---|---|
| Settings mirrored through your account | No, and a teammate opening a shared profile arrives without it |
| A transfer file for a second computer | Yes, inside the file sealed with the passphrase you set |
| The folder your own cloud syncs | Yes, the same sealed file by the same road |
| A settings export to a plain file | Only if you press Include secrets: the app asks, and leaving it out is the default |
| Duplicating a profile | No, the copy starts with no pair of its own |
What this does not do
- It is not a password manager. One pair per profile, no vault, no search across accounts, no generator, and nowhere for the backup codes a site hands you.
- You can fill a window on the built in engine only, and shipped builds start on ARMANOS Browser, so it is the exception. The button refuses, names the reason, and copying is the way across.
- The sign-in page you save is a note. Nothing opens it for you, and nothing checks which page you are filling.
- Copying leaves the password on the system clipboard. Any program on this computer can read a clipboard, and the app does not clear it.
- The system seals the password on Windows only. On macOS the key ships inside the program, and on Linux the pair is written as typed even with a keyring service running.
How to check
Each claim above sits in one file.
- The profile list reaches the window without the password
- apps/desktop/src/main/main.js · apps/desktop/test/login-stays-local.js
- Filling picks the sign-in form and the page sees real input
- apps/desktop/test/login-stays-local.js · apps/desktop/test/страница-ловушка-живьём.js
- What each system does to the password on disk, and a value that will not open is not erased
- apps/desktop/src/lib/profiles.js · apps/desktop/test/login-in-keychain.js · apps/desktop/test/шифрование-правда-по-системам.js
- Only frames of the same site are filled
- apps/desktop/src/main/main.js · apps/desktop/test/подстановка-входа-в-свои-рамки.js
Questions
- Does the pair reach your server?
- No. Profile settings travel while you are signed in, and the pair is not among them.
- What opens the password on this computer?
- On Windows, the system, with a key tied to your Windows account. On macOS, a key that ships inside the program. On Linux nothing is needed: the password is written as typed.
- Can the page grab the value as it is filled?
- In the main document the page itself cannot reach in and swap what goes into the field. On a build with no separate worlds that protection is gone, inside a frame it is gone always, and only frames of the same site are filled.
- Why is the first password field skipped?
- Because the first one usually belongs to sign-up. The password goes to the field the form marks as the current password, and a matching pair of new boxes is skipped.
- Is there a master password on the app?
- No. Anyone already signed in to this computer can open it, so the boundary that matters is your user account. A single profile can carry a password of its own.
Keep the login where the account is
In ARMANOS, save the pair on the profile that uses it and fill it into the open form.