> For the complete documentation index, see [llms.txt](https://docs.unbrowse.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.unbrowse.ai/logins-and-vault.md).

# Logins and the vault

Unbrowse keeps logins in its password manager. Agents and the CLI never see a password. The SDK only sends one when your own code saves a login (`logins.save`, `accounts.connect`), for services that run their own save-login page; nothing ever reads a value back.

## Saving a login

* In the console at `/app/vault`, directly.
* From a one-time link. When a run or autofill needs a login nobody saved, the service returns a `/app/vault-request/…` link. The CLI opens it (agents can make one on demand with the MCP tool `unbrowse_credentials_request`); the person signs in to Unbrowse and saves the username or email, password and optional 2FA seed. Agents wait with `unbrowse_credentials_status`, then repeat the call.
* CSV import from Chrome, Bitwarden, 1Password, LastPass, Firefox, Apple and Dashlane in the console.

## Using a login

* **Cloud browser:** `unbrowse_browse_act` with `action: "autofill"` fills the page's login form (username or email, password, 2FA code). `fill` on one ref with `vault: "password"` fills one field. Snapshots show `[from vault]`, never the value.
* **Replay:** learned capabilities that sign in take the login from the vault themselves. If a browserless run hits a login wall on a site with a saved login, Unbrowse signs in once in the browser, caches the session, and keeps replaying without one until it expires.
* **Sessions are kept.** Once a browse session is signed in, later runs and sessions on that site start signed in, so an emailed code is needed once. A logged-out session is dropped.

`unbrowse logins` lists saved logins as masked hints: site, label, which fields are saved.

## Custody

| Vault                       | Keys                                                                                                           | Use                                                   |
| --------------------------- | -------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
| Agent vault                 | Server-sealed: AES-256-GCM per item, per-workspace data key wrapped by a key-encryption key, bound to the item | Unattended runs                                       |
| Private vault (rolling out) | Zero-knowledge: keys derived in your browser (PBKDF2 650k ⊕ HKDF of a Secret Key), AES-256-GCM per item        | Logins the service cannot read until you release them |

The owner releases Private-vault logins to runs for 1 hour, 8 hours or for good. Recorded traces and evidence are scrubbed of typed secrets. Passwords typed in free text to the chat are redacted.

## Rules for agents

* Never ask the user for a password. Never pass one as a tool argument.
* On a login page, `autofill`. No login saved → give the person the save-login link and wait.
* A read-only route you teach may be shared to the public registry; logins and writes never are.