Skip to content

FAQ

Jump to bottom
Timo Triebensky edited this page Oct 14, 2026 · 2 revisions

Answers that kept coming up on issues after the v3 rewrite.

The v3 update

Where did the old extension go?

v3 is a full rewrite (Svelte, TypeScript, WXT). It shipped as an update of the existing store listings, because Chrome was about to drop the Manifest V2 build. The old source is on [legacy-v2](https://github.com/nextcloud/passman-webextension/tree/legacy-v2).

Issues and pull requests against that old code were closed. If something is still wrong on current v3, open a new issue against master.

My configuration disappeared after the update. Are my passwords gone?

Your vault stays on the Nextcloud server. v3.0.0 only dropped the local extension setup (server URL, account, which vault is active, extension settings). Sign in again and unlock the same vault.

Since v3.0.1 the welcome / setup screen can import the previous extension's settings.

Reloading the popup in the middle of a first-time setup returns you to the last saved step. The connection is stored when that step finishes.

Debugging and logs

How do I see what the extension is doing?

The default log level is Error, so unexpected behaviour often leaves an empty console.

  1. Open Extended settings (of the settings section in the extension popup).
  2. Under Logging, set Log level to Debug. Save the settings.
  3. Reproduce the problem, then read the consoles below.
  4. Set the level back to Error. Debug logs can contain URLs, labels, and other vault data.

Two consoles matter:

What you are looking at Firefox Chrome, Brave, Vivaldi, other Chromium
Background script (login, sync, URL matching, vault decrypt) [about:debugging#/runtime/this-firefox](about:debugging#/runtime/this-firefox) → Inspect on Passman chrome://extensions (or brave://extensions, vivaldi://extensions) → enable Developer mode → Service worker on Passman
Page / password picker / doorhanger DevTools on that website (F12). Reload the page after changing the log level. Same

A red NetworkError or CORS error for a host like github.com comes from the website, not from Passman.

What should a bug report include?

  • Extension version (shown in Extended settings) and browser name + version
  • Whether it also happens in a new vault with one test credential
  • The background-script console with log level Debug, while you reproduce it
  • For autofill or the in-page picker: the page console as well

A fresh vault that works, while your real vault does not, almost always means one credential in the real vault is breaking the whole list. See search and matching.

Connecting to Nextcloud

Save keeps spinning, or I get "NetworkError when attempting to fetch resource."

The extension calls the Passman API (/index.php/apps/passman/api/v2/...) with the URL you entered. Check these in order:

  1. Scheme. A host without http:// or https:// is stored as https://. For a server without TLS, type the full http://… URL yourself. Plain HTTP works in current builds (Firefox needed a content-security-policy fix in v3.1.0; before that, Firefox upgraded those requests to HTTPS).
  2. The browser must be able to open that exact URL. A name from /etc/hosts, an internal DNS name, or a name-based virtual host is fine, as long as this browser profile resolves and reaches it. "Access through untrusted domain" is Nextcloud rejecting the host; add it under trusted_domains in your Nextcloud config.
  3. Two-factor authentication. Use a Nextcloud app password, not the account password.
  4. The certificate. The browser profile has to trust the server certificate, including a self-signed one you installed yourself.

v3.1.0 improved the errors shown when login fails. If the server never answers, the extension waits for the connection timeout and then tries again, so the button can sit on "checking" for a long time.

Unlock and saved account data

Why does it ask for the extension unlock password after every browser start?

v2 could store that password in plain text in the browser profile. v3 does not.

Extended settings → Auto-unlock on browser start keeps the extension unlocked across restarts without storing the password itself. Anyone who can run code in this extension, or read this browser profile from disk, can then open the vault without the password. Locking the extension turns auto-unlock off; turn it back on in Extended settings afterwards.

The Nextcloud account data stored by the extension is encrypted with the unlock password. That part is required for the extension to sync.

You can change the unlock password in Extended settings.

Several vaults or servers

Can I use more than one vault?

The extension uses one active Nextcloud server and that server's default vault at a time. Saved servers are listed under the server settings. Switch changes which server is active. That is a hard switch: the credential list, autofill, and the password picker follow the active vault only.

Several vaults on the same account are not merged into one list yet. v2 (maybe?) did that. Bringing a combined view back is planned (#372); it will not be a line-by-line port of the v2 code. Combining credentials from different Nextcloud instances is not planned.

Until then, put the credentials you want in the browser into the vault you select as default, or switch the active server when the vaults belong to different accounts.

Search, autofill, and site matching

The popup search, the badge, or autofill suddenly matches nothing. The doorhanger wants to save a login I already have.

-> Working on it!

One credential with a bad field aborts matching or text search for the whole vault. Typical causes:

  • The URL is not a real URL (new URL(...) throws).
  • The credential cannot be decrypted: an interrupted vault-password change, or a shared credential whose data does not match the shared key. A server bug around editing shared credentials was fixed in Passman 2.4.5 (passman#768).

What to do:

  1. For credentials still encrypted with an old vault password, or a shared-key mismatch, open Vault recovery from the credential list (shows up when decryption fails) or from the active server in settings. A dry run changes nothing; a repair uploads only after you start it. This feature will be available with v3.3.0.
  2. Set the log level to Debug and read the background console while you search or open the site.
  3. Create a new vault, add one credential for the site, and select that vault in the extension. If that vault matches and fills, the old vault contains a bad record.
  4. The standalone client at https://binsky08.gitlab.io/passman-svelte can flag some undecryptable credentials. It does not flag every malformed field (a decrypted false is still "valid" JSON).

The doorhanger offers to save a login when no credential matched the page exactly. A vault that cannot be matched therefore asks to save every time. Disable it under Extended settings if you do not want that prompt.

Manual search in the popup and the password picker matches the label and the description only. The url will be added to the manual filter soon.

What do "Ignore … for site matching" mean?

These live under Extended settings → Website credential filter options.

Each checked box widens the match (the comparison becomes less strict):

  • Ignore protocol — http and https match each other
  • Ignore subdomain — login.example.com matches a credential stored for example.com
  • Ignore path — only the host has to match; this one is on by default, and it is the right choice when the same account is used on several paths
  • Ignore port — host:8443 matches host

Leave Ignore subdomain off when different subdomains use different credentials.

Page rules override those global options for one domain. They apply to the domain, not to a single path. A rule's "ignore subdomain" not applying on the subdomain itself is #392.

A credential created by the doorhanger stores the host (or IP) in the label. Edit the credential if you also want the port or a path in the label. Put a normal URL in the URL field; a fake URL may break matching for every other credential. Shouldn't but could.

A login form is not detected (WordPress and similar)

v3.0.0 ignored username fields whose name was not a usual username name. WordPress uses name="log" (id="user_login"). Recognition was extended after that. If a site still does not fill, set log level to Debug, reload the page, and read the page console: it logs which forms and hidden fields were skipped. Extra detectors (mutation observer, popstate, interval) are checkboxes under Form detection in Extended settings.

If the issue persists, add the failing website to this issue: #335

Firefox "Never remember history"

"A mutation operation was attempted on a database that did not allow mutations."

Firefox refuses IndexedDB when Settings → Privacy & Security → History is Never remember history or Always use private browsing mode.

Passman then uses an in-memory offline cache (Extended settings → Cache storage). The same fallback is selected automatically when IndexedDB cannot be opened. The cache is cleared when the extension background script restarts, and the vault is loaded from the server again. This mode is slower than IndexedDB and is meant for those profiles, not as the everyday setting.

Large vaults

The popup takes a few seconds to open or to filter

Decryption runs in the background script. Filtering runs in the popup. The work grows with the number of credentials, so a vault of several hundred entries is noticeably slower than one of thirty. The list is virtualized so it does not render every row at once. A multi-second delay on a small vault is a different problem; check the background console.

Deleting a credential

Delete has no "are you sure"

Mark credential as deleted sets the credential's delete time, the same way the Nextcloud Passman app does. Restore it from the deleted section in the Passman app. A confirmation dialog is still an open request (#395).

Development and test builds

Day-to-day setup is in the README: Bun, bun install, then bun run dev or bun run dev:firefox. Load the directory WXT prints under .output/ (chrome-mv3-dev for Chromium).

To try a CI build before it is on the stores:

  1. Download extension-builds.zip from the Actions run (or the zip attached to the pull request).
  2. Unzip it, then unzip the inner passman-webextension-prod-firefox.zip or passman-webextension-prod-chrome.zip.
  3. Firefox: [about:debugging#/runtime/this-firefox](about:debugging#/runtime/this-firefox) → Load Temporary Add-on → the manifest.json inside the extracted folder. A warning about web_accessible_resources.use_dynamic_url on that temporary install is harmless.
  4. Chromium: extensions page → Developer mode → Load unpacked → the extracted folder.

Store releases are built by GitHub Actions on tags. See the README for bun run build / bun run zip.

Clone this wiki locally