Popout Authenticator

Lock and protect your accounts

Set a password lock, keep the recovery code, unlock with a passkey, choose auto-lock, and hide codes while sharing your screen.

Demo accounts only.

How the lock works

The lock is optional. You can add accounts and fill codes without it. When you turn it on, your accounts are stored in an encrypted vault (AES-256-GCM). A random vault key opens the vault. Your password, your recovery code, and each passkey can each unlock that key.

Your password is stretched with Argon2id before it is used. This is deliberately slow, so guessing passwords is hard. A long password that mixes kinds of characters is harder to guess.

Open the lock settings from the toolbar popup: the lock button shows "Lock settings" while the lock is off. You can also open the full page and choose "Lock".

Without the lock, "Turning off the vault lock stores your secret keys on this device without encryption." Turn it on if other people can use your computer or browser profile.

Turn on the password lock

  1. Open "Lock". Under "Vault lock (optional)", type a password in "Password (8+ characters)".
  2. Type it again in "Repeat password".
  3. Watch the strength meter: "Weak", "Fair", or "Strong". It counts length and kinds of characters (lowercase, uppercase, digits, symbols). "Strong" needs 12 or more characters and at least three kinds.
  4. Select "Turn on lock".
  5. Save the recovery code that appears (next section).

Fewer than 8 characters shows "The password must be at least 8 characters." Different passwords show "The passwords do not match." The meter is a guide. The rule you must meet is the 8-character minimum. If your administrator sets password rules, you may also see "The password does not meet your administrator's rules."

In version 1.0.0, snapshots saved while the lock was off stay unprotected after you turn it on. Someone with access to your browser profile could still read the secret keys in those earlier snapshots.

1.0.1 From version 1.0.1, turning on the lock also re-encrypts those earlier snapshots.

If browser sync is on, turning on the lock lets your accounts sync encrypted to other devices. You can change this in Settings → Sync. See Backup, export, and sync.

Keep the recovery code

The recovery code unlocks your vault if you forget the password. It appears once, right after you turn on the lock.

  1. Select "Copy", or select "Save as text file" and keep the file somewhere safe. Writing it down also works.
  2. Type the code again in the box ("Type the recovery code again.") and select "Confirm". Spaces, hyphens, and capital letters are ignored.

If the codes differ, you see "The code does not match. Check it and try again."

1.0.1 From version 1.0.1, the toolbar popup hides "Save as text file", because the save dialog closed the popup. Use "Copy" there, or open the full page to save a file.

To replace the code, open "Lock" and use "Create new recovery code". Enter your current password, then confirm the new code. "Creating a new recovery code invalidates the previous one."

Unlock

When the vault is locked, the popup shows "Locked".

After you unlock with a recovery code, Popout shows a new one: "The recovery code you used no longer works. Save your new recovery code." Select "Copy", store it, then select "I saved it".

1.0.1 From version 1.0.1, the code you just used keeps working until you confirm the new one with "I saved it".

Unlock with a passkey

A passkey lets you unlock with your device (fingerprint, face, PIN, or security key, depending on the device and browser) instead of typing the password.

  1. Unlock the vault with your password first. Otherwise you see "Unlock with your password first."
  2. Open "Lock" → "Passkeys" and select "Add passkey".
  3. Confirm in the browser prompt ("Confirm in the passkey prompt.").

To remove one, enter your current password and select "Remove" next to it.

Passkeys do not replace the password or the recovery code. Keep both.

Auto-lock and "Lock now"

Select "Lock now" in the lock settings, or the lock button in the popup toolbar, to lock right away. Under "Automatic lock", choose when it locks by itself. The default is 15 minutes.

If your administrator set a time, the page says it was set by your administrator, and you cannot change it.

1.0.1 From version 1.0.1, auto-lock also runs on time while a separate window or the side panel stays open, and the QR capture page counts as an open screen for "When all authenticator views close".

Extra verification before filling

This is optional. When it is on, you verify with your registered device each time before a code is filled into a page. Viewing and copying codes stay available. "Extra verification is off. While the vault is unlocked, codes are filled without a password or passkey check."

  1. Turn on the password lock and save the recovery code.
  2. Add a passkey. Or open "Lock" → "Extra verification for code filling (optional)" → "Set up extra verification" and follow the steps. You tick "I saved my recovery code somewhere safe." and select "Continue to device registration".
  3. Switch on "Verify with your device before filling codes". You see "Code-fill verification is on."

To turn it off, use the same switch and verify with your device. If your device is lost, open "Cannot use device verification?", enter your password, and select "Turn off code-fill verification with password". Your vault lock stays on. You must turn this off before you can turn off the lock or remove your last passkey. It is not available in Firefox.

Hide codes on screen

"Hide or show codes" masks every code in the popup as dots. Use it before you share your screen. The popup shows "Codes are hidden." An open share window closes when you hide codes.

It has no default key. To set one, open your browser's extension keyboard shortcuts page and assign a key to "Hide or show codes". The page is in the extensions menu of your browser. The shortcut for filling codes is Ctrl+Shift+Y (Command+Shift+Y on a Mac). While the popup is open, Alt+Shift+H hides or shows codes too. The hidden state lasts for the browser session.

Change or turn off the password

If you forget the password

  1. Unlock with your recovery code or a registered passkey. You can keep using your accounts this way; each recovery-code unlock gives you a new code to save.
  2. In version 1.0.0, "Change password", "Turn off lock", and exports ask for the current password, so a forgotten password cannot be reset.
  3. If you have no password, no recovery code, and no passkey you can use, the vault cannot be opened, and Popout cannot reset the password for you.
  4. In that case, restore from a backup file if you have one, or set the accounts up again at each service. Resetting deletes everything stored in this browser, so save a raw copy first (see Backup, export, and sync).

Save the recovery code and a backup file before you need them.

Deleted accounts and the trash

When you delete an account, you see "Move this account to trash? It will be permanently deleted after 30 days." Choose "Move to trash". Open "Trash" to see how many days are left for each item. Select "Restore" to get one back, "Delete permanently" to remove it, or "Empty trash". More on backups and recovery. If something is wrong, see Troubleshooting.