Habits the browser taught you · habit 01 of 40

The password manager fills it

The box is empty and the icon in the corner does not light up. On any other site that means the page loaded badly. Here it usually means the page is exactly what it appears to be.

The habit

You click into the login box and wait for the manager to fill it, the way it fills every other login you have.

Why it is automatic

Repetition built this one. A person with an ordinary online life signs in to dozens of services, and remembering dozens of distinct passwords was never realistic. Managers removed that problem so completely that filling stopped feeling like a step. It became a sensation instead: the field goes grey, the page is right, carry on.

The advice was correct too, and it was given for years by people who knew what they were talking about. Let the manager generate it, let it store it, never reuse anything. Part of why that worked is the hostname matching itself, which refuses to fill on the wrong site while the eye is still reading the logo.

The result is an inverted signal nobody chose. A filled field reads as arrival. An empty one reads as breakage. Almost nowhere else does an empty field mean something worth stopping for, so almost nobody stops.

What it actually does here

The mechanics are unchanged and that is the point. A manager keys its entries to a host string, and an onion host is a host string like any other, so it is matchable, storable and syncable in the same way. What it is not is looked up anywhere. The manager cannot tell a site you have no entry for from a site you should not be making one for.

A lookalike is treated with the same evenness. A second address differing somewhere in the middle of the string is simply a different host, so it gets no fill, and that absence is useful. Save an entry on the second one as well and both are taught, and the manager will never mention that there are now two.

Saving is not a preference, it is a write. A row appears in the profile vault holding a hostname, a username, a secret and usually some timestamps, and that vault is a file on disk. If the profile is signed into an account, the row goes wherever that account goes.

That leaves the silence itself. Elsewhere, a manager declining to fill is the strongest warning most people ever get that they are not where they think they are, and it arrives before any visual detail is examined. It exists here too, but only for a reader who keeps one entry and notices its absence. Everyone else learned long ago to read that silence as a small software fault.

Why the silence is the useful part

Two different things look identical when the manager offers nothing. One is that no entry exists yet, which is normal on a site you have not used. The other is that an entry exists and the host in front of it does not match. The interface for both is the same absence.

A reader who keeps exactly one stored entry gets a signal out of that. Fill means the string matches the one stored, and no fill means it does not, at which point the move is to compare the bar against the published set rather than to retype anything.

What a saved entry is made of

People picture a saved password as a password. It is a small record with several fields, most of them not secret in the way the password is. The hostname in particular sits in the clear in a database whose file name is well known, and the vault does not need unlocking for its list of sites to be legible.

Hostname

The exact host the entry was made on, which all later matching is done against.

Username

Whatever sat in the first field, including an address you use elsewhere.

Secret

The password, encrypted at rest, decrypted whenever the profile is unlocked.

Timestamps

Creation and, on managers that record it, the last time it was used.

Sync state

Whether the row belongs to an account, which decides if it stays on one disk.

What to do instead

None of this argues for a weaker password. It argues for keeping the record somewhere that does not travel and does not offer itself.

1. Keep credentials for this on paper, or in an offline store that is not the browser profile carrying the rest of your life.
2. Decline a save prompt rather than dismissing it, since declining usually stops that host asking again and dismissing does not.
3. Read an empty field as information, and compare the bar against the published set before typing into it.
4. If an entry already exists, delete it, then open the same list on every device signed into that profile.
5. Never let a manager that learned one address vouch for a second. A match proves a string is the same string and nothing else.

How to notice you did it anyway

Finding out whether this has already happened takes a minute, and it is worth doing on every profile rather than the obvious one.

• Open the saved logins list in each browser profile and search it for the market name and for any host ending in onion.
• Look for entries you do not remember creating, the usual shape of a prompt accepted while thinking about something else.
• Check whether profile sync is on. If it is, assume the same list exists on at least one other device.
• On a shared computer, check the other user accounts, since a manager belongs to a profile and not to a person.

What readers ask about this habit