Hi all,
Thank you for a phenomenal open-source password manager! I posted some PRs with performance bug fixes for the Android app, but I really miss the TOTP copy-to-clipboard function I had on Bitwarden. I realize this might not be for everyone, so I tried to build it in a security conscious way, disabled by default.
Two-step logins on Android today: the Passbolt autofill fills username and password, the site asks for the TOTP, and the user has to switch to Passbolt, find the same entry, copy the code and switch back. Other password managers have an option to put the entry’s TOTP in the clipboard right after autofill, so it is ready for the second step.
I have implemented this as an opt-in setting (Settings > Autofill > “Copy TOTP automatically”, off by default) on top of 3.2.0-56:
- After a resource is chosen in the autofill flow, if the setting is on and the entry has a TOTP, the current code is placed in the clipboard (sensitive flag, existing 30 s auto-clear) right before the dataset is returned.
- Only when the form had no TOTP field of its own; if it had, the code has already been filled in.
- Works for both the native Autofill and the Accessibility autofill path.
- No extra fetch or decryption: the code is already computed for the autofill payload.
Code: https://github.com/conscientsystems/mobile-passbolt-android/tree/upstream/copy-totp-on-autofill (25 files, unit tests updated, qa build tested on Android 16).
Pull request against the GitHub mirror: https://github.com/passbolt/mobile-passbolt-android/pull/43
Happy to adjust to whatever you prefer (per-account setting, RBAC gating, naming).
Kind regards,
Tor