Password manager and import
Save, fill and check your passwords in the browser, with everything encrypted before it syncs.
Fill a login
Click into a username or password field on a sign-in page. Halo shows its menu under the field with the logins saved for that site; pick one to fill it.
- Halo fills only the top frame of a page whose address matches the saved site exactly, and only after you choose a login.
- Pages never see your vault. A separate, isolated script shows the menu and Halo's main process handles every request.
- Autofill is paused on any tab an AI agent is controlling, and in private and Tor windows.
Save new logins
When you sign in to a site, Halo saves the login automatically and shows a bar with Undo. On sign-up forms, Halo suggests a strong password. To stop saving on a site, add it to the never save list; the list syncs with your settings. Both saving and the in-field menu can be turned off in Settings, Passwords and autofill.
The passwords page
Open Passwords from the menu, or Settings, Passwords and autofill.
- Search, reveal, copy (the clipboard is cleared automatically), edit and delete logins.
- Password check flags weak and reused passwords.
- Cards and addresses live in the same section. Card security codes (CVV) are never stored.
- The vault page (
halo://vault) also holds secure notes, aliases and one-time codes (TOTP), plus a password and passphrase generator.
Import from another browser
Choose Import during setup, or open halo://import. Halo looks for these browsers on your computer and imports bookmarks, history and passwords from the profiles you tick:
Chrome, Dia, Arc, Brave, Edge, Vivaldi and Opera.
On a Mac, macOS may ask you to allow access to the other browser's Keychain entry; this is how Halo decrypts its saved passwords. Passwords that cannot be decrypted are skipped and counted in the import log.
Import a CSV file
Export your passwords as CSV from Safari, Firefox, 1Password, Bitwarden or another browser, then choose Choose CSV or .halo file on the import page. Logins you already have are skipped. Delete the CSV afterwards: it holds your passwords in plain text.