The Password App
AI-powered password automation and digital safety for macOS
The uncomfortable truth
Right now, some of your passwords are sitting in a database on the dark web. Not maybe. Definitely. 16-19 billion stolen credentials are actively circulating. If you've used the internet for more than a few years, statistically speaking, at least a few of yours are in that pile.
You probably know this. You've gotten the breach notification emails. You've seen your email pop up on HaveIBeenPwned. You've thought "I should really change those passwords."
And then you didn't.
Why we do nothing. It's not laziness. It's friction.
Here's what "just change your passwords" actually looks like:
Open password manager. See 150+ accounts.
Pick one. Navigate to the site.
Hunt for Settings → Security → Change Password (it's never in the same place)
Enter your old password
Generate a new one
Copy it carefully
Paste it twice
Save to password manager
Pray it worked
Repeat 149 more times
When I finally forced myself to do this after a breach, it took 6 hours. Six hours of mechanical clicking. For what a computer should obviously be able to do.
So most people do the math: 6 hours of tedium vs. probably-nothing-bad-will-happen. And they gamble.
The gamble isn't working
The numbers say the gamble is losing:
78% of people reuse passwords across sites
41% of successful logins use previously compromised credentials
Credential stuffing (trying leaked passwords on other sites) is now the #1 attack vector
Here's how it plays out: LinkedIn gets breached in 2012. You used the same password for your email. Someone buys that database in 2024, tries it on Gmail, and now they own your digital life.
Password managers solved the "remembering passwords" problem. But they created a new one: maintenance debt.
Your vault is a graveyard. Passwords from 2019. Passwords from the LastPass breach era. Passwords using that pattern you came up with in college. You know they're weak. You know some are compromised. But the activation energy to fix them is just too high.
The solution needs to match the problem
The problem isn't knowledge - everyone knows they should update passwords.
The problem isn't tools - password managers are everywhere.
The problem is friction. Changing passwords requires human attention at every step. Click here, wait, click there, paste this, confirm that.
So I built an AI that does the clicking for you.
---
The architecture: Desktop App + browser-use + Chrome Extension
After months of iteration, I landed on an architecture that actually works. And it turns out, the biggest AI labs are betting on the same pattern.
The three-layer stack
Layer 1: Desktop app (Electron)
Handles the secure stuff - importing your passwords from 1Password/Bitwarden/LastPass, queueing jobs, never letting credentials touch the network.
Layer 2: Python agent (browser-use + LLM)
The brains. Uses https://github.com/browser-use/browser-use (89.1% on WebVoyager benchmark) with Gemini 2.5 Flash for navigation and Grok for validation. Reasons about the page, decides what to click, handles the weird edge cases.
Layer 3: Chrome extension (the secret weapon)
Instead of launching a detectable Playwright browser, we control your actual Chrome via:
Native Messaging - Stable stdio bridge between app and extension
Chrome DevTools Protocol (CDP) - Trusted mouse/keyboard events that sites can't distinguish from real input
Your real cookies and sessions - Already logged in everywhere
Why this architecture wins
Anti-bot bypass
Sites like Cloudflare, DataDome, and reCAPTCHA detect Playwright/Puppeteer browsers. They check for automation fingerprints, missing browser APIs, headless indicators.
When you use the user's actual Chrome browser? You're just... a user. Real browsing history, real cookies, real fingerprints.
Zero-knowledge security
Your passwords never leave your machine. The desktop app stores them in memory only, passes them to the agent via secure injection (invisible to the LLM), and clears them immediately after use.
The AI sees the browser. It never sees your actual credentials.
Session persistence
You're already logged into Gmail, your bank, your work apps. The extension inherits all of that. No re-authentication needed.
Graceful degradation
If a site blocks CDP clicking, we fall back to DOM clicks. If that fails, we extract the accessibility tree and try a different approach. Multiple fallback layers = higher success rates.
---
The same pattern big tech is betting on
What validated this architecture: Anthropic and Google independently arrived at the same design.
Claude Code Chrome Extension
Anthropic just https://www.anthropic.com/news/claude-for-chrome:
CLI tool (like our desktop app)
Native Messaging to Chrome extension
Extension controls browser via CDP
Maintains your login sessions
Run /chrome in Claude Code and it opens tabs, reads console errors, interacts with pages - same architecture.
Project Mariner (Google DeepMind)
https://deepmind.google/models/project-mariner/ is Google's browser agent from I/O 2025:
Chrome extension as the control surface
Observe → Plan → Act loop on browser state
Runs in your actual browser, not a sandbox
Google charges $249.99/month for access. We're at $2.99/month.
Why everyone landed here
Desktop-app-to-extension solves three problems:
1. Trust - Extensions run with user permission in their real browser
2. Capability - CDP gives you everything: screenshots, DOM, network, input
3. Stealth - No automation fingerprints because it IS the user's browser
It's not coincidence that Anthropic, Google, and us arrived at the same architecture. It's the only one that works for real-world browser automation.
---
Current state
- v0.49.0 shipping now
- 89%+ success rate on major sites
- Zero cloud credential storage
- macOS only (Windows coming)
Free tier: 5 password changes/month
Unlimited: $2.99/month or $27.99/year
The longer vision: there needs to be a digital guardian who works tirelessly on an individual's behalf to scrub and protect the individual's data and protects their privacy. The Password App is on the mission to be your digital guardian.
---
Would love feedback from the IH community. Anyone else building on browser-use or the extension-bridge pattern? Curious what anti-detection challenges others have hit.
Try it: https://thepassword.app
Comment