Fill codes into sign-in pages

Fill a code with one click, the right-click menu, a keyboard shortcut, or a button next to the code field, on the sites you allow.

Demo accounts only.

How filling works

Popout puts the current code into the code field of the page you are on. You start every fill yourself, by one of these ways:

Way	Where you start it	Picks the account
Popup	"Fill" next to the suggested account, or "Fill on this page" in an account's menu	You
Right-click menu	Right-click a text field → "Fill 2FA code"	Popout, from the saved sites
Shortcut	`Ctrl`+`Shift`+`Y` (Mac: `Command`+`Shift`+`Y`)	Popout, from the saved sites
Field button	"Fill code" button beside the code field	Popout, from the accounts you turned it on for

Nothing is filled on its own when a page loads. Filling does not need a vault lock or a passkey. Add an account and you can use it.

Sites you allow

Two kinds of "allowed" apply, and they are separate.

Saved sites for an account

Each account can have site addresses, for example example.com. A saved address also covers its subdomains. Popout fills and auto-submits only when the page is on a saved site of that account.

To add one by hand: open the account's "⋯" menu → "Edit", type addresses in "Site addresses (separate with commas or new lines)", then select "Save".
When you copy a code on a site that is not saved for that account, Popout asks "Remember this account for example.com?" (with the site you are on). Select "Remember" to save it, or "No".
If you fill on a site that is not saved, Popout asks first: "Remember and fill", "Fill once" or "Cancel". "Fill once" fills but never auto-submits.

Site access in the browser

Popout does not keep access to all websites. It gets access in these ways:

Selecting the toolbar icon, using the right-click item, or pressing the shortcut gives access to that one tab for that action.
In a separate window or side panel, the browser may need your approval for the site. Popout then shows a button such as "Allow filling on example.com". If you decline, you see "The code was not filled because site access was not allowed."
The field button asks for access to the sites you save for it (see below).

Auto-submit is on by default. Turn it off in Settings → "Copying and privacy" → "Automatically confirm after filling a code". It presses the only confirmation button of a code-only form, and only on saved sites. It never applies to "Fill once" or to filling on copy.

Open the sign-in page and wait for the code field.
Select the Popout icon in the toolbar. The account that matches the site shows a "Fill" button.
Select "Fill". On success you see "Code filled." and the popup closes.

If no account shows "Fill", open the "⋯" menu of the account you want and choose "Fill on this page". Suggestions can be turned off in Settings with "Suggest accounts for sites (turning off clears site usage history)".

In a separate window or side panel, the row button needs the optional tabs permission. Popout asks "Let suggestions follow the tab you switch to?" with "Allow" and "Dismiss". Without it, use "Fill on this page" in the menu. See Popup, separate window, and side panel.

1.0.1 From version 1.0.1, a fill still finishes after the browser's site-access prompt closes the popup.

Right-click the code field on the page.
Choose "Fill 2FA code".

Popout picks the account whose saved site matches the page. If several match, it uses the one you filled most often on that site. If it cannot pick one, nothing is filled. Popout opens its popup, or shows "Choose an account." on the page.

1.0.1 From version 1.0.1, Firefox also shows the menu item on password-type code fields, and filling works from the separate window in Firefox.

Fill with a keyboard shortcut

Press Ctrl+Shift+Y (Mac: Command+Shift+Y). This runs "Fill the 2FA code on this page". It works like the right-click menu. Click the code field first.

There is also a second command, "Fill the code of the best matching account". It has no default key and does the same thing.

Change a shortcut

Chrome: open chrome://extensions/shortcuts.
Edge: open edge://extensions/shortcuts.
Firefox: open the Add-ons page, select the gear icon, and choose "Manage Extension Shortcuts".

Find Popout Authenticator in the list and set the keys you want.

The button next to the code field

On sites you choose, a small "Fill code" button appears beside the code field. Select it to fill. It never fills by itself, and at most three buttons show on a page.

Turn it on for one account

Open the account's "⋯" menu → "Edit".
Enter the site in "Site addresses (separate with commas or new lines)". Use only the site's address, for example github.com.
Turn on "Fill codes on manually specified sites".
Select "Save" and allow site access in the browser prompt. If you decline, you see "Site access was not allowed, so the button stays off."

Turn it on for known services

In Settings → "Fill codes on websites", turn on "Recognize known services automatically". This covers GitHub, GitLab, Google, Cloudflare, Dropbox and JetBrains. Popout finds the account by service name. If you use the toolbar popup, Settings opens in a small window for the permission prompt.

Turn it off

Edit the account, turn off "Fill codes on manually specified sites", and select "Save". For known services, turn off "Recognize known services automatically". Site access that no other account needs is released.

1.0.1 From version 1.0.1, the button sits at the middle of the field and follows it when the page moves it down.

Copy a code instead

Select an account in the popup to copy its code. "Copy next code" in the menu copies the following code of a timed account.

Settings → "Copying and privacy" → "Clear the clipboard after copying" clears the clipboard 30 seconds later, if you copied nothing else. It asks for the optional clipboard read permission. Safari does not support it.
"Also fill the input field when copying" fills the page too. It never auto-submits.

If Popout finds no field to fill, it copies the code and shows "Code copied. Paste it into the input field." on the page.

1.0.1 From version 1.0.1, a code copied because filling failed is also cleared from the clipboard when that setting is on.

Device verification

You can ask for a check with your registered device (fingerprint, PIN or similar) each time a code is filled. It is off by default and not available in Firefox. Set it up in the lock settings. See Lock and protect your accounts.

HOTP, Steam and Battle.net

HOTP: every fill moves the counter forward by one and uses that code. Fill once per sign-in.
Steam and Battle.net accounts fill like timed accounts.
If a timed code has about two seconds left, Popout waits for the next code.

Where filling does not work

Pages without https. Popout shows "Codes are not filled on pages without a secure (https) connection." Local test addresses (localhost, 127.0.0.1) are allowed.
Browser pages such as the extension store. You see "Codes cannot be filled on this page. Try again on the site where you want to sign in."
A frame from another site. The frame's own address must be a saved site of the account, and the top page must be https too. Otherwise you are asked as described under "Sites you allow".
Fields too short for the whole code. The code is copied instead.

1.0.1 From version 1.0.1, Popout no longer picks a phone-number field that shows no sign of being a code field.

If filling fails

Click inside the code field, then try again.
If you see "The vault is locked. Unlock it and try again.", unlock Popout.
If you see "Permission to fill on this site is missing...", allow site access or open Popout from the toolbar on that site.
If you see "The target tab or page changed. Try again on the site you want to fill.", start again on the page.
If the code is rejected, check the device clock. See Troubleshooting.