Let the agent sign in. Keep the password from it.
Tovik Vault stores your logins encrypted on this computer and fills them straight into the page, so the agent gets past a sign-in screen without the secret ever entering its context.
What happens at a login screen.
Agents usually stall at sign-in and hand the job back to you. With the vault, the handoff happens inside the browser instead.
- 01 The agent reaches a sign-in page It asks the vault for help instead of asking you to type.
- 02 The vault checks this site’s rule Allowed, ask-first or never — you set it per site.
- 03 The browser fills the form The secret goes into the page. The agent only learns that sign-in worked.
Decide per site, not per prompt.
Let the agent use your mail login freely, make billing ask first, and keep the bank off-limits entirely. Rules apply to every task until you change them, and each fill lands in the audit log.
Try the rules on the right — this demo only changes the page you’re looking at.
- mail.acme.co
- billing.acme.co
- bank.acme.co
- git.acme.dev
Keys held by the hardware.
Unlock with Touch ID or your system password. The key that opens the vault sits behind the Secure Enclave on Mac, or the TPM on Windows where the PC has one; otherwise a software-protected key is used.
Encrypted before it touches the disk.
Entries are sealed on the device before they’re written, under a key bound to that hardware. Nothing in the vault is sent to a model provider — not the passwords, not the list of sites.
Bring the logins you already have.
Import passwords and passkeys from the password manager or browser you use today, in one pass. After that, the vault fills them for you and for the agent — under the same site rules.
Stop pasting passwords into chat boxes.
Tovik Vault comes with every plan, including Free.