Vallkey fills only what you pick, and only where it belongs.
Logins
Click a username or password field. The menu under it lists the logins saved for that site, best match first. Pick one, and Vallkey fills the username and password.
On a site that asks for the username first, Vallkey fills the username on the first page, and the password on the next.
One-time codes
On a page that asks for a two-step verification code, click the code field and pick the login whose code it wants. Vallkey fills the current code. See Two-step verification codes.
Payment cards
On a checkout page, click the card number field and pick a card. Vallkey fills the number, the name, the expiry and the security code, in the form each field expects.
The menu names the site that will get the card. Where a payment provider puts card fields in frames of its own, the menu also names that provider, so picking the card confirms both.
Names and addresses
On a shipping or sign-up form, click a name or address field and pick an identity. Vallkey fills the name, email, phone and address.
Where Vallkey fills
- Cards and identities fill only on https pages. Never on plain http.
- A login saved for an https site is never offered on an http page.
- Each frame is matched on its own address. Another site’s frame inside your bank’s page gets nothing from your bank’s login.
- Items in the Archive or in Recently Deleted are never offered.
Which site is which
By default, a login is offered on any page of the same site: one saved for bank.example is offered on login.bank.example. Vallkey tells sites apart with the Public Suffix List, so alice.github.io and mallory.github.io are different sites, and so are bank.co.uk and evil.co.uk. A lookalike letter from another alphabet makes a different site too.
Lookalike sites
Vallkey never fills a site that only looks like one where you have a login. A phishing page can still ask for your password, so the browser extension warns you as well. On a site such as paypa1.com, paypal-login.com, or one with a letter from another alphabet, the menu under the field, the popup and the prompt to save a login say Not paypal.com, and offer nothing to fill.
A site where you do have a login of your own never gets the warning, and neither does the same name in another country, such as amazon.de for amazon.com. The AutoFill list on iPhone and iPad, and Android’s fill sheet, say the same above their logins.
On your phone
On iPhone and iPad, the system fills and asks Vallkey what to fill: see iPhone and iPad. On Android, Vallkey is the autofill service: see Android. The rules for which login belongs where are the same everywhere.
If a page doesn’t offer what you expect, see When Vallkey doesn’t offer a login.
Last updated October 3, 2026