Passwords
Litr saves the passwords you sign in with and fills them in for you, in its own vault in your Mac's keychain.
Saving
When you sign in to a site, a strip under the toolbar asks Save the password for … on …?
- Save keeps it. If you already had one for that account, the strip asks to Update it instead.
- Never for This Site stops Litr from asking there.
- Not Now asks again next time.
Sign-ins in two steps, such as Google's (the account on one page, the password on the next), are saved as one.
Forget tabs never offer to save.
Filling in
On a sign-in page for a site you have a password for, the strip says Sign in to … as with your accounts. Click one and Litr fills in the account and the password. A 🔑 in the address bar brings the strip back.
The strip only comes up for a sign-in form: a password field, or the first step of a two-step sign-in (an e-mail or user name field with Next or Sign in, as on Google's). Search boxes and fields for picking a person, as in an issue tracker, don't count. Not Now keeps it away on that site until Litr is restarted, unless a password field shows; the 🔑 in the address bar still brings it back.
Litr never fills in by itself, and only in the page's main frame, on the site the password was saved for or one of its subdomains. It checks the site itself rather than trusting the page.
Before it fills in, Litr asks for Touch ID or your Mac's password, so no one else at your Mac can sign in as you; see Confirming it's you. You can turn that off in Settings under Confirm it's you before filling in.
One-time codes
Litr can also make the six-digit codes an authenticator app makes, for sites with two-step sign-in, and fill them in after the password.
Setting up
When a site turns on two-step sign-in, it shows a QR code for an authenticator app, and usually a setup key to type instead.
- From the QR code: with the QR code on screen, choose Set Up One-Time Codes from QR Code (Litr menu or the command palette). Litr reads it and keeps its key with your saved password for that site. If you have more than one account there, it asks which one.
- From the setup key: in the Passwords list, click Add Code… by the
account and paste the key (
JBSW Y3DP …) or anotpauth://link, then press Enter.
Sites ask for a first code to finish. Right after setting up, the strip offers it: click Fill In Code, or Copy Code if Litr didn't find the field.
Signing in
On a site's code page (after the password), the strip says One-time code for … with your accounts that have codes, the one you just signed in with first. Click it and Litr fills in the code; a row of one-digit boxes is filled box by box. As with passwords, Litr never fills in by itself.
Litr recognises a code field by what the site marks it as
(autocomplete="one-time-code"), by its name (one-time code, verification
code, 2FA and the like, but not promo or postal codes), or as a row of six
one-digit boxes.
Keeping the key safe
The keys are kept in your keychain like the passwords, as items labelled "… one-time code (Litr)". With the password and the key in the same place, whoever can open your Mac's keychain has both steps; that is the trade-off Apple's Passwords app and 1Password make too. For the accounts that matter most (your e-mail, your Apple Account), consider keeping the codes in a separate app or on a security key.
Only time-based codes (TOTP) are supported, with SHA1, SHA256 or SHA512 and 6 to 8 digits: what Google, GitHub, Microsoft, AWS, Cloudflare and most others use. Codes sent by text message or e-mail aren't Litr's to make.
The Passwords list
Settings → Passwords… (or Litr → Passwords…) lists every saved password by site and account, with a search field.
- Show, Copy and Copy Code ask for Touch ID or your Mac's password first; see below.
- Add Code… sets up one-time codes for the account; Remove Code removes them (click again to confirm, then confirm it's you).
- Delete asks you to click again to confirm, then to confirm it's you, and removes the account's one-time codes too.
- Never saved lists the sites you told Litr not to save for; click one to let Litr offer again.
Confirming it's you
Showing, copying or deleting a saved password or one-time code key asks for Touch ID (or your Apple Watch, or your Mac's password). So does filling one in, unless you turn Confirm it's you before filling in off in Settings. macOS's dialog says what it's for, such as "fill in your password for github.com".
Once you've confirmed, Litr doesn't ask again for five minutes, or until the screen locks, the Mac goes to sleep or another user switches in, whichever comes first.
Importing passwords
From Chrome, Arc, Dia, Brave, Edge, Vivaldi and Opera
In Import from another browser (Settings, the Bookmarks menu, or the Passwords list), choose the browser and turn on Passwords. These browsers encrypt their passwords with a key in your keychain, so macOS asks whether Litr may use that key ("Litr wants to use your confidential information stored in 'Arc Safe Storage'"). Enter your Mac's password and click Allow. Litr reads the passwords, keeps them in its own vault, and leaves the other browser as it was. Sites you told that browser never to save for come along too.
From Safari, Firefox and password managers
Export the passwords as a CSV file, then click Import CSV… in the Passwords list:
- Safari and the Passwords app: File → Export All Passwords…
- Firefox: Settings → Passwords → ⋯ → Export Passwords…
- 1Password, Bitwarden and others: their CSV export.
A CSV file holds your passwords unencrypted. After importing, Litr offers to move it to the Trash; empty the Trash afterwards.
Importing again adds only accounts Litr doesn't have yet, and never overwrites a password you saved in Litr.
Where they're kept
In your login keychain, as internet passwords labelled "… (Litr)", encrypted by macOS and readable only by Litr. They don't sync to other devices, and they aren't in Apple's Passwords app. Deleting Litr's keychain items (or a password in the list) removes them.
Web apps don't use the vault: each is an app of its own.
Passkeys
Sites that offer passkeys use the ones in your iCloud Keychain instead; see Troubleshooting.