# Passwords and passkeys in other apps (/docs/vault/autofill-passkeys)

Use the codai Vault as the password and passkey provider on Android and as the passkey provider on Windows 11. What each system version supports, how to turn codai on, and how to pick codai when another manager is offered first.

The vault can hand a password or a passkey to another app or to a website, so that you do not copy and paste. This works on Android and on Windows 11. The iPhone app does not offer passwords or passkeys to other apps.

| System               | Passwords                                      | Passkeys       | Needs                                                 |
| -------------------- | ---------------------------------------------- | -------------- | ----------------------------------------------------- |
| Android 14 and newer | In apps that ask Android for a saved password  | Create and use | codai app from the APK on GitHub                      |
| Android 11 to 13     | In apps and on websites, with Android autofill | No             | codai app from the APK on GitHub                      |
| Windows 11           | No                                             | Create and use | codai desktop from the Microsoft Store, Windows Hello |

The codai app from Google Play contains neither service.

## Android [#android]

### Turn codai on [#turn-codai-on]

Android lists the vault as **codai vault**. The settings page has a different name and place on each phone brand and Android version, so search the system Settings.

- **Android 14 and newer:** search Settings for "passkeys", open the page for passwords, passkeys and accounts, and turn on **codai vault** in the list of services. You can keep your current manager on as well.
- **Android 11 to 13:** search Settings for "autofill service" and choose **codai vault**. Android uses one autofill service at a time on these versions.

Then open the codai app and unlock the vault with your password once, so that biometric unlock is set up. Until then codai answers "Unlock the vault once with your password in the codai app" and opens the app.

### Fill a password [#fill-a-password]

**Android 14 and newer.** When an app asks Android for a saved sign-in, the system sheet lists the logins that match under **codai vault**. If the vault is locked, the sheet shows **Unlock codai vault** first. After you pick a login, codai checks again that the app may receive it, asks for your fingerprint or face, and then hands the password to the app.

On these versions codai is not an autofill service: it does not fill a password field that a web page or an app shows without asking Android for a saved sign-in. Copy the password from the codai app for those.

**Android 11 to 13.** Tap a username or password field. Android shows the logins that match and, below them, **Search codai vault**. When the vault is locked it shows **Unlock codai vault** instead.

- Tap a login: codai opens a fingerprint or face prompt titled **Fill this login**, which names the login and the app or site it goes to. The fields are filled after you confirm. When the same step has just unlocked the vault with your fingerprint or face, that check counts.
- Tap **Search codai vault** to pick any login yourself. The **Choose a login** screen lists the logins **Linked to this app** first, then **All logins**, and says where the password will be filled. The same prompt follows.

Nothing is filled without that confirmation.

**Which logins are offered**

- **In a browser:** a login whose saved website is the same domain as the page, or a parent of it. A login saved for `example.com` is offered on `login.example.com`, never on a look-alike such as `example.com.evil.io`. codai believes the page address only when it comes from a browser on its built-in list of known browsers (Chrome, Firefox, Edge, Brave, Samsung Internet and others). Any other app that reports a web page is treated as an app.
- **In an app:** a login you saved from that same app, or a login for a website that names the app. Sites publish the list of their own Android apps (Digital Asset Links). codai reads that list from the site and compares the signing certificate of the app. The name of an app proves nothing, so a name alone never matches a login.

When an app is not linked to the login you picked, codai answers "codai did not fill this login: the app is not linked to it." On Android 11 to 13 you can still choose the login yourself with **Search codai vault**. On Android 14 and newer, copy the password from the codai app.

### Save a password [#save-a-password]

**Android 14 and newer.** When an app offers to save a new sign-in, choose **codai vault** in the system sheet, then the vault: **Personal vault** or a shared vault. If the vault already holds a login for that account, codai asks **Update the saved login?** with **Update** and **Save as new**.

**Android 11 to 13.** After you sign in, Android asks whether to save the password with **codai vault**.

The password is encrypted on the phone before it is uploaded.

### Create and use a passkey (Android 14 and newer) [#create-and-use-a-passkey-android-14-and-newer]

1. On the site or in the app, start creating a passkey.
2. In the system sheet, choose **codai vault** and the vault to save into. The entry reads "Save this passkey in the codai vault (synced to your devices)".
3. Confirm with your fingerprint or face.

To sign in, pick the passkey listed under **codai vault** and confirm with your fingerprint or face. Every sign-in asks again.

The private key of the passkey is stored as an item in the vault. It syncs to your other devices and also works through the Windows passkey provider below. It cannot be shown, copied or exported.

When the request comes from a browser on the list of known browsers, codai checks that the page belongs to the domain of the passkey and refuses otherwise. When it comes from another app, the site of the passkey has to name that app, the same way as for passwords. If it does not, codai refuses and says that the app is not linked to the site.

### When Android offers another manager first [#when-android-offers-another-manager-first]

Android decides the order of the sheet, and usually proposes Google Password Manager or the phone maker's manager first. If you confirm at that point, the password or passkey is saved there, not in codai.

Before you confirm, open the other options of the sheet and choose **codai vault**. In Chrome on Android 16 the path is **More options**, then **Save another way**, then **codai vault** and **Personal vault**. The wording differs between Android versions and phone brands.

When you sign in, the same applies: pick the entry marked **codai vault**.

## Windows 11 [#windows-11]

### What you need [#what-you-need]

- A Windows 11 version that lets other apps provide passkeys (24H2 with the 2025 updates, or newer). The app checks this itself: otherwise it says "This version of Windows does not support passkey providers."
- The codai desktop app installed from the **Microsoft Store**. The installer from the website shows "Available in the Microsoft Store version." instead.
- The vault set up in the desktop app with Windows Hello. See [Add a second device](./devices.mdx).

### Turn codai on [#turn-codai-on-1]

1. In the desktop app, open **Vault** and find **Windows passkey provider**.
2. Choose **Register as Windows passkey provider**.
3. Open Windows **Settings > Accounts > Passkeys > Advanced options** and turn on **codai Vault**.
4. Back in the app, the section shows **On**. **Off in Windows** means step 3 is still to do.

### Create and use a passkey [#create-and-use-a-passkey]

Keep the codai desktop app running: Windows passes each request to it.

- **Create:** when a site offers to create a passkey, pick **codai Vault** in the Windows dialog and confirm with Windows Hello.
- **Sign in:** pick the passkey in the Windows dialog and confirm with Windows Hello.

If the vault is locked, the same Windows Hello prompt unlocks it. You are not asked twice.

Windows shows the list of passkeys that the desktop app handed to it. The app updates the list when you unlock the vault and while its Vault tab is open, so a passkey you created on your phone appears in the Windows dialog after that. A passkey deleted on another device leaves the list the same way.

### When Windows offers another manager first [#when-windows-offers-another-manager-first]

Windows and your browser propose their own store first: the browser's password manager, Windows Hello on this PC, or a phone. If you confirm there, the passkey is not saved in codai.

In the Windows Security dialog choose **Save another way**, then pick **codai Vault** from the list.

## Sign-ins and Last used [#sign-ins-and-last-used]

After a passkey sign-in through codai, the passkey shows **Sign-ins** and **Last used** in the vault on every device. **Last used** is recorded when codai signs the request, also when the site then rejects the sign-in. Keep that in mind before you [remove duplicate passkeys](./delete-undo.mdx).