Sign in from your browser, approve on your phone.

Docs › Use BetterSign Passwords

How it works

Most password managers keep your passwords in the browser, behind a master password. BetterSign does the opposite: your passwords never live in your browser. They stay in the BetterSign app on your phone, protected by the phone’s secure hardware.

When you sign in to a website, the extension asks your phone for that one login. Your browser shows a short code, your phone shows which website is asking, and you tap the matching code and approve with your fingerprint or face. Your phone sends only that login, encrypted so that only the browser tab that asked can read it. The extension fills the form and forgets the password.

The browser holds no passwords and no vault to steal. All it holds is permission to ask your phone, and every ask needs you.

Before you start

• A phone with a screen lock (fingerprint, face, PIN or pattern). Without a screen lock, the app asks you to set a BetterSign PIN. To fill your computer’s browser, the phone needs to be Android for now. AutoFill on the phone works on iPhone and Android.
• The BetterSign app, the early-access build we send you.
• A computer with Chrome, Edge or Brave.
• Your phone and computer don’t need to be on the same network. They find each other through BetterSign’s relay, which only passes along encrypted messages and can’t read them.

1. Set up the app

1. Install the BetterSign app and open it.
2. Create your identity when the app asks. It’s made on your phone, and its keys stay in the phone’s secure hardware.
3. Open the menu and choose Vault (Passwords). This is where your logins live.

Your passwords belong to the identity you pair your first browser with (normally your personal one). That stays true even if you switch to another identity later.

2. Add your logins

You can bring everything over from your current password manager in one go: see Switch from another password manager. To add a login by hand:

1. In Vault (Passwords), tap Add.
2. Enter the Website (for example github.com). If a site uses several addresses, list them separated by commas.
3. Enter the Username or email and the Password. To make a new strong password, tap Generate and choose a length.
4. Leave Fill on as Same site unless you need it stricter (below).
5. Tap Save and confirm with your fingerprint, face or PIN.

Every change, and every time you show or copy a password, asks for your fingerprint, face or PIN.

3. Install the extension

1. On your computer, install the BetterSign extension from the link in your early-access email.
2. Pin it to the toolbar: click the puzzle-piece icon next to the address bar, then the pin beside BetterSign.

The extension asks to read and change data on websites. It needs that to find login forms and fill them. It never stores a password, and it sends nothing to your phone until you click into a login field or ask it to fill.

4. Pair your browser with your phone

You do this once per browser.

1. On your computer, click the BetterSign icon. The popup shows Pair with your phone and a QR code.
2. On your phone, open Settings → Browsers and tap Pair a browser. Scan the QR code.
3. Check the browser it describes, give it a name you’ll recognize (“Work laptop”), tap Pair and confirm with your fingerprint.
4. Both screens now show the same 6-digit number. If they match, press It matches on both. If they don’t, press It doesn’t match and start again. Someone else may have answered the pairing.

The pairing code is valid for 5 minutes. If it runs out, click New code in the popup.

5. Sign in to a website

1. Make sure the BetterSign app is open on your phone. During early access the phone hears requests only while the app is open. A notification for when it’s closed is coming.
2. Open the website’s login page and click into the username or password field (or press Tab into it).
3. Your browser shows a code, such as 47-21, next to the field and in the popup.
4. Your phone shows the request: the website’s real address in large type, which browser is asking, and three codes. A first visit label means you’ve never approved this site before. Take a second look at the address.
5. Tap the code that matches your browser, tap Approve, and confirm with your fingerprint or face. If you have more than one login for the site, pick the account first.
6. The form fills. Press the website’s own sign-in button, or let BetterSign press it for you (below).

Other ways to ask for a login on the current page: click the small BetterSign button in the login field, press Ctrl+Shift+L (⌘+Shift+L on a Mac), or click Fill this page in the popup.

A request waits about 2 minutes for your answer. To stop one, click Cancel in the popup.

When there’s no saved login

Your phone says No saved login for <site> and offers Add login for this site, with the address already filled in. Save it, and the sign-in carries on.

Faster sign-in options

Both options are in the extension popup. Neither skips the code or your fingerprint.

• Submit after filling (this browser, every site). After filling, BetterSign presses the site’s sign-in button for you. It’s off at first.
• Sign in automatically on <site> (per site). Your phone is asked as soon as the login page opens, so you don’t click into the field. It’s offered once you’ve filled that site at least once. Even then it only fires for the page’s main sign-in form in the tab you’re looking at, never a sign-up form, and at most once every 5 minutes per site.

Tap the code or type it

On your phone, Settings → Browsers lets you choose how you confirm the code:

Why a code at all? Your phone can check that a request came from your paired browser. What it can’t check is that you are at that browser right now. The code ties your approval to the screen in front of you, so a request someone else starts, from malware or a stolen laptop, shows a code you can’t see, and can’t be approved by reflex. A wrong answer cancels the request.

Passwords on your phone

BetterSign can fill your saved logins on the phone itself, in Safari, Chrome and other apps, through the phone’s AutoFill. No extension is needed, and it’s off until you turn it on.

1. In Vault (Passwords), turn on AutoFill on this phone (the card at the top) and confirm with your fingerprint, face or PIN.
2. Tap Open Settings and choose BetterSign as your AutoFill provider. On Android, Chrome also needs Settings → Autofill services → Autofill using another service.
3. Tap a username or password field in a website or app, pick the BetterSign suggestion, and unlock with your face, fingerprint or passcode. The login fills in.

Websites are offered only the logins saved for that site. In apps you pick from your logins (your phone doesn’t say which website an app belongs to). Every fill asks for your face, fingerprint or passcode. AutoFill keeps its own encrypted copy of your logins (never your notes) for the phone to read. Turning it off deletes that copy. Saving a new login from AutoFill isn’t offered yet; add it in the app.

You can also copy a password: open Vault (Passwords) and tap the copy icon next to the login. It’s marked as sensitive, so your phone hides it in clipboard previews, and BetterSign clears it from the clipboard after 1 minute.

Manage your browsers

Settings → Browsers on your phone lists every paired browser and when it was last used. From there you can:

• Rename a browser.
• Revoke it with one tap if a computer is lost or something looks wrong. It can’t ask for anything after that.
• Resume a paused browser. A browser is paused after three wrong codes within 10 minutes, and the app asks whether you want to unpair it.

To remove BetterSign from a browser, click Unpair in the popup, then revoke it on your phone as well.

Troubleshooting

“No response from your phone”

Open the BetterSign app on your phone and keep it open, then ask again. During early access the app has to be open to hear requests.

My phone says there’s no saved login, but I have one

Check the address on the phone against the login’s Website. Some sites sign you in on a different address (for example accounts.example.com or a separate domain). Add that address to the login, separated by a comma. Also check Fill on: Same origin and Exact only match the address you saved.

The browser says to pair again

Your phone’s keys changed, for example after a key rotation or restoring a backup. Click Pair again in the popup and pair as in step 4.

The form didn’t fill

The extension never fills hidden fields, and it only fills the page that asked. If the page changed address while you were approving (a redirect), ask again. Logins split across two pages (username first, password on the next) aren’t fully supported yet. Neither are login forms inside embedded frames.

I lost my phone

A paired browser can only ask, and every ask needs your phone and your fingerprint, so a browser on its own gives nobody your passwords. During early access your passwords aren’t in the encrypted backup yet, so keep your old password manager until that ships. See After you import.

What it doesn’t protect against

• Malware on your computer. Once a password is filled into a page, software that can read the page can see it, just as if you typed it. BetterSign keeps such malware from getting your other passwords.
• A hacked website. A password filled into a compromised site can be captured there.
• Reading someone else’s code to you. If someone talks you into entering a code from their screen, no prompt can stop that. Only approve sign-ins you started.