The previous Password Depot browser extension was originally developed for Firefox 2 and 3: a browser generation from the late 2000s. Today Firefox stands at version 150, Chrome and Edge have introduced an entirely new architecture with Manifest V3, and modern web applications work fundamentally differently than they did nearly two decades ago. This evolution could no longer be addressed by incremental updates to the previous code and protocols. The new extension was therefore built from the ground up.
With Password Depot 19, this new generation arrives. It delivers reliable autofill in complex web applications, passkeys, TOTP autofill, and a substantially tighter integration with the desktop application. Equally important: it has been deliberately designed with a version adapter layer capable of supporting multiple major versions of the desktop application in parallel. The extension will therefore work without disruption with Password Depot 19.x.x and all future major versions - a technology-driven rebuild like the one between version 18 and 19 is not to be expected again.
The new extension is distributed through the official browser stores (Microsoft Edge Add-ons and Chrome Web Store). Customers who continue to run Password Depot 18 can obtain the matching extension as a manual download from our previous versions page.
Audience: IT administrators and technical decision-makers in enterprise environments.
What has changed technologically
Two developments have fundamentally reshaped what browser extensions need to do:
Modern browser platforms
With Manifest V3, Chrome and Edge have introduced a new security and architecture model. The new extension is built for this model from the ground up and takes full advantage of it: from energy-efficient status checks via chrome.alarms to sandboxed communication with the desktop application.
Modern web applications
Microsoft 365, Salesforce Lightning, SAP UI5 and comparable platforms encapsulate their input fields in Web Components and Shadow DOM. React, Vue and Angular manage form state internally. The new extension reliably detects and serves these structures: through native setters, synthetic events, and multi-path submit detection. The result: autofill works where it has been industry-wide difficult until now.
What the new extension delivers
Autofill and form detection
Detection of input fields inside Shadow DOM and Web Components (relevant for Microsoft 365, Salesforce Lightning, SAP UI5, Vaadin, Shoelace, Ionic and others)
Values are set via native setters of the input elements plus synthetic
input/changeevents, so React, Vue and Angular forms actually accept the filled valuesDetection of TOTP fields and automatic insertion of the second factor from the matching entry
Support for CSS-masked password fields (
-webkit-text-security), not justtype="password"Multi-path submit detection via the submit event, button clicks (multilingual word list), the Enter key, and XHR/fetch calls
Passkeys
The extension can manage passkeys (FIDO2/WebAuthn) on behalf of the desktop application. The behaviour can be enabled or disabled per user via a "Handle passkeys" setting.
User interface
Multilingual interface: German, English, French, Spanish, Dutch - automatically based on browser language or manually selected
Light and dark themes, following the system setting automatically
Status display for the desktop connection with clearly distinguished states (connected / connecting / inactive / version mismatch / error)
Direct per-entry actions: copy username, copy password, copy TOTP, open URL, edit entry
Search with debounce (300 ms) and entry filtering
What administrators need to know
Rollout
The extension's manifest ID remains unchanged. Existing ADMX/GPO policies for forced installation and configuration through Edge or Chrome continue to work.
Permissions
The extension declares the following permissions under Manifest V3:
Table scrolls sideways
Permission | Purpose |
|---|---|
| Communication with the Password Depot desktop application |
| Persisting settings and ignore lists |
| Access to the active tab for autofill and entry actions |
| Injecting content scripts and clipboard operations |
| Copying credentials to the clipboard |
| Energy-efficient status checking of the desktop connection |
Communication with the desktop application
The extension uses native messaging exclusively: the sandboxed channel provided by Chrome and Edge for this purpose. The local loopback port (TCP 25109) used by the previous generation is gone. As a result:
no additional firewall exceptions for local connections are required
no EDR/AV rules for the loopback port are needed
the status check runs via
chrome.alarms(once per minute) instead of continuous polling: significantly lower background load, relevant for notebooks and VDI environments
User-configurable settings
Save passwords (offer to save on login)
Manage passkeys
Auto-fill on a unique match
Theme (automatic / light / dark)
Language (browser default / manual selection)
Clipboard clear timeout
Ignored domains (hostname-based instead of URL-based: simplifies exceptions for internal applications)
Support and diagnostics
The extension provides structured logs, accessible and exportable via the browser's developer tools (service worker console). For support cases, this significantly speeds up problem isolation.
Security
Several core components operate on a modern foundation:
Password generator: Web Crypto API (
crypto.getRandomValues) with unbiased selectionPwned check: k-anonymity procedure via the desktop application; full password hashes do not leave the device
UI isolation: all injected dialogs run in Shadow DOM or in an extension-owned iframe and are inaccessible to page scripts
Clipboard: auto-clear via
chrome.scriptingwith a configurable timeout, reliable under Manifest V3Session cache: short-lived data (for example, a newly created entry that has not yet been saved) is stored in
chrome.storage.sessionwith a five-minute lifetime and survives neither a browser restart nor service worker inactivity
Comparison overview
Table scrolls sideways
Area | Extension for Password Depot 18 | Extension for Password Depot 19 |
|---|---|---|
Manifest version | 3 | 3 |
Interface languages | German, English | German, English, French, Spanish, Dutch |
Communication channel | Native messaging with loopback fallback | Native messaging |
Form detection | Classic HTML forms | Classic forms, Shadow DOM, Web Components |
Framework compatibility | Standard websites | Additionally React, Vue, Angular (via native setters and synthetic events) |
TOTP autofill | not included | included |
Passkeys | not included | included, configurable per user |
Status check | Interval polling |
|
UI isolation | Iframe | Shadow DOM and extension iframe |
Theme | Light | Automatic / light / dark |
Ignore list | URL-based | Hostname-based |
GPO/ADMX rollout | Supported | Supported (same manifest ID) |
Requirements
Table scrolls sideways
Component | Requirement |
|---|---|
Browser | Microsoft Edge, Google Chrome or another Chromium-based browser with Manifest V3 support |
Desktop application | Password Depot 19.0.3 or later |
Operating system | As per the desktop application's system requirements |
Installation | Via browser store or central deployment through GPO/ADMX |
FAQ
Why does the new browser extension require Password Depot 19?The new extension uses a unified native messaging protocol that forms the basis for all new capabilities – from passkey management to TOTP autofill to version mismatch detection. This protocol is part of Password Depot 19.0.3 and later. Supporting earlier major versions in addition would require adapter layers that would compromise the stability and maintainability of the new extension.
Can I continue to use Password Depot 18?Yes. The browser extension built for Password Depot 18 remains available as a manual download from the previous versions page for Chrome, Edge and Firefox. It can be loaded as an unpacked extension via the browser's developer mode, or distributed in managed environments through the standard mechanisms for self-hosted extensions (e.g. Edge ExtensionInstallSources, Chrome force-install via update URL, Firefox ExtensionSettings).
No. An upgrade is worthwhile if your users work with modern web applications (Microsoft 365, Salesforce Lightning, SAP interfaces, and similar), if you want to use passkeys or TOTP autofill, or if you need the properties described under "What administrators need to know".
Will I need another new extension when future major versions are released?No. The new extension has been built with a version adapter layer capable of supporting multiple major versions of the Password Depot desktop application in parallel. It is therefore designed to work with Password Depot 19.x and all future major versions. A technology-driven rebuild like the one between version 18 and 19 is not to be expected again.
What does the new extension offer for organisations and administrators?Concretely: more reliable autofill in modern web applications, passkey and TOTP support, lower background load (relevant for notebooks and VDI), no more local loopback port (simplified firewall/EDR rules), hostname-based ignore lists, structured logs for support cases, five languages.
Does anything change for group policy rollouts?No. The extension's manifest ID remains unchanged; existing ADMX/GPO configurations continue to work.
Where can I find more information?Password Depot 19 release notes
Administrator handbook, "Browser extension" section
For technical questions: support@password-depot.de