Passwords

Vandle fills your logins from 1Password into Web tabs and into the sign-in of a connection, and types passwords into a terminal. It does this with the 1Password command-line tool, not with the browser extension.

Why not the 1Password extension

You can install the 1Password extension in a Web tab, but it cannot connect to the 1Password desktop app. The desktop app only talks to browsers that are code-signed, and Vandle is not. Without the desktop app, the extension falls back to its own sign-in, and that does not finish in Vandle.

So Vandle talks to 1Password itself, through the official 1Password CLI. You pick the login in a Vandle window. The first time, and again after a while without use, 1Password asks you to confirm with your system sign-in, such as Windows Hello.

What turning it on opens up

Read this before you connect 1Password.

• The 1Password CLI has to be connected to the desktop app: in 1Password, turn on Settings > Developer > Integrate with 1Password CLI.
• Once that is on, every program that runs under your user account can ask 1Password for your items, the same way Vandle does. That includes scripts and AI agents with access to a shell. Vandle cannot prevent this.
• 1Password asks you to confirm such a request with your system sign-in, such as Windows Hello. The confirmation is not for one item: once you confirm, that program can read every item of the account - names, usernames and passwords. It stays allowed for as long as it keeps using 1Password, ending after 10 minutes without use and after 12 hours at most, or when 1Password locks.
• So only confirm a request you started yourself. If a confirmation shows up while you did nothing in Vandle, decline it.
• If you do not need it, leave it off, or turn it off again in 1Password.

What Vandle itself does with your logins:

• It never offers them to an AI agent. The part of Vandle that holds them cannot be reached from Vandle's agent server at all.
• It never writes a username or a password to its log, and never stores them. A login goes from 1Password straight into the page.
• It fills a login only into the page you asked for it on. If that tab shows another site by the time you choose, nothing is filled.
• A password or user name it types into a terminal is the one exception to keeping nothing: the tab keeps it in memory while it is open, so that an agent reading the terminal sees [hidden] in its place - also when the other side printed it.

Set it up

1. Install the 1Password CLI. On Windows: winget install AgileBits.1Password.CLI. On macOS: brew install 1password-cli. On Linux, follow 1Password's instructions for your distribution.
2. In the 1Password app, turn on Settings > Developer > Integrate with 1Password CLI.
3. In Vandle, open Settings > Passwords, read the notice, tick that you understand it and click Connect 1Password.

Until then, the hotkey does nothing in Vandle and goes to the page as usual.

Fill a login

1. In a Web tab, click into the login field.
2. Press Alt+P. A list of logins for this site opens at the top of the page.
3. Choose one with the arrow keys and press Enter, or double-click it. Type to filter by name, user, vault or account.
4. If 1Password asks, confirm. Vandle fills the user name and the password.

Esc closes the list. You can change the key under Settings > Hotkeys.

Let a connection sign in from 1Password

In the Edit connection dialog, choose under Authentication:

• Login from 1Password - for any connection that signs in with a user name and a password: SSH, SFTP, WebDAV, databases, MQTT, RDP and VNC.
• Key from 1Password - for whatever signs in over SSH: SSH, SFTP, Docker and MQTT through SSH. It takes an item of the kind SSH Key.

Then click Choose in 1Password… and pick the item. Vandle stores only which item it is - never the password or the key. Each time the connection opens, Vandle takes the login or the key from 1Password, under the same confirmation as everything else, and keeps it in memory for that connection only. If 1Password is not connected or you dismiss its confirmation, the connection asks for its sign-in as usual.

Sign in to a connection

When a connection asks for its sign-in - SSH and SFTP, WebDAV, a database, an MQTT broker, RDP or VNC - the dialog has a button From 1Password. It opens the same list, with the items that name the machine first, and puts the user name and the password into the dialog. Sign in is still yours to press.

Type a password into a terminal

1. In an SSH or console tab, wait for the prompt - sudo, docker login, psql.
2. Press Alt+P. The list shows the line the terminal waits on, so you see where it goes.
3. Choose the item:
   • Enter types the password and sends it.
   • Ctrl+Enter types the user name and sends it.
   • With Shift as well, either is only typed, not sent.

When a prompt asks for the user name first, take it with Ctrl+Enter, then press Alt+P again at the password prompt: the item you just took is at the top and already picked, so Enter is enough. The tab remembers which item it was for five minutes - the item, not its values.

An agent reading the terminal sees [hidden] for the password wherever it shows, and for the user name wherever it stands as a word of its own.

The list holds every 1Password login, password, server and database item; those whose title or website names the machine come first.

A password is typed as if you typed it. If the line is not a password prompt, the terminal shows it like anything else you type - check the line in the list before you choose.

The list shows the logins whose website in 1Password belongs to the same site as the page: shop.example.com finds a login saved for login.example.com, but never one for another site under a shared ending such as co.uk or github.io. Logins that belong to exactly this address come first.

With more than one 1Password account, Vandle looks in all of them and shows which account a login is in.

When it does not work

• The 1Password CLI was not found - install it, then try again. Vandle finds it without a restart.
• The 1Password CLI cannot reach the 1Password app - start 1Password, unlock it and check that Integrate with 1Password CLI is on.
• No login for this site - the login's website in 1Password belongs to another site. Add this address to the login in 1Password.
• There is no login field on this page - click into the field first, then press the hotkey again.

To stop, click Disconnect 1Password under Settings > Passwords, and turn off the CLI integration in 1Password.