Is Intuitive Password®: Password Manager safe?

Intuitive Password autofills login fields from URL query-string parameters on every website it visits, with no origin allowlist.

On nearly every page you visit, the extension checks the page URL every 2 seconds for ip_autofill, ip_autofilluserid, and ip_autofillpassword parameters and, if present, decodes and types them straight into the page's detected username and password fields. Only the vendor's own idx.us and intuitivepassword.com domains are excluded, so any other site that sets those parameters can trigger the fill. Separately, the extension encrypts vault credentials and master-key material sent to its backend with an AES key that is hardcoded identically into every install, so that layer adds no real confidentiality beyond HTTPS.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.