Scalebrowser Secret Layer
Your agent signs in everywhere and never sees a password.
It gets a placeholder, Scalebrowser types the real value, and only on the site it belongs to. Keys a page shows are blacked out before your agent reads them.
Included in the Free plan · No credit card · Your vault stays on your PC
One email with the download link, nothing else. Privacy
Included in the Free plan · No credit card · Your vault stays on your PC
Inside the Secret Layer
- 01
A placeholder, never the password.
Your agent gets a name for every value a profile holds. It types the name, and Scalebrowser types the value into the page.
- 02
New accounts get a strong password.
Your agent signs up with a password Scalebrowser draws for it and keeps in the profile's vault before the first key is typed.
- 03
2FA codes, worked out on the spot.
The two-factor secret stays in the vault. When a site asks for a code, the current one is computed and typed in.
- 04
Passkeys that stay in the profile.
Each profile keeps its own passkeys. Your agent signs in with one and never holds the key.
- 05
A lookalike site gets nothing.
A login is typed only on its own domain, and only over https. On any other page the field stays empty and your agent is told why.
- 06
Keys on a page become placeholders.
When a page shows an API key, your agent reads a placeholder in its place: in the page, in screenshots, videos and PDFs.
Workflows use the vault. Their AI never does.
Log In from Vault and Create Credentials type the values for a run. Ask AI, AI Extract, AI Decide and Agent Step never get one.
Only you see a value, behind your vault password.
Every profile keeps its logins, keys and passkeys in a vault of its own on your PC. Open it with your vault password to look at any value yourself.
On by default. Off when you want it all.
Switch the Secret Layer off and your agent gets the whole page: HTML, network requests and scripts. Vault passwords stay hidden either way.
Secret Layer
Keeps values an agent uses out of everything an agent reads.
Your agent reads placeholders.
Questions about the Secret Layer.
A line or two each. For everything else there is the Help center.
The common ones, and all you store.
API keys from AWS, Stripe, GitHub, Google, Slack, npm, GitLab, SendGrid, Anthropic and OpenAI, by their format. And every value a profile keeps, even when a page shows it base64 or URL encoded.
On your PC, encrypted.
In each profile's vault, inside Scalebrowser on your own PC, encrypted at rest. When you sync profiles between your PCs, they travel encrypted too.
Its own site, unless you widen it.
A login goes only to the domain it belongs to, and only over https. For a key you choose: its site in matching fields, its site in any field, one exact host, or anywhere.
Their names, never their values.
Your agent can list a profile's cookies and delete them. Their values stay hidden from it; you can see them behind your vault password.
Yes, in a command Scalebrowser starts.
Scalebrowser can start a program with a stored key in its environment, npm publish with your npm token for example. Your agent runs the command and never reads the token. See the agent docs.
Yes, in every plan.
It runs on your PC, so Free has it too, for up to 3 profiles. Every paid plan has it for more profiles, and you can try one for 7 days.
Hand over the logins. Keep the passwords.
Store a login once. Your agent uses it and never sees it.
One email with the download link, nothing else. Privacy
Secret Layer in every plan, Free included · No credit card · Runs on your PC
Secret Layer in every plan, Free included · No credit card · Runs on your PC