Passwords & payment cards

Chervil's encrypted, passphrase-locked vault for saved logins and payment cards — how it stores them, how the 🔑 and 💳 fill buttons work, and the security guarantees (never auto-submitted, never shown to Sprig, CVC never stored).

Chervil can save your logins and payment cards and fill them into real sites for you — from one encrypted vault, protected by a single master passphrase. Sprig never sees any of it, and Chervil never submits a form or a payment for you.

The vault

Everything is stored in a local, encrypted vault. It's protected two ways at once:

Encrypted with AES-256-GCM under a key derived from your master passphrase (via scrypt). The passphrase is never stored — if you forget it, there's no backdoor and no recovery.
Additionally wrapped with your OS keychain (Electron safeStorage), so the file is bound to your OS account too.

You set the master passphrase once, in Settings → Security, and enter it once per session to unlock. The vault auto-locks — when Chervil is hidden to the tray, after an idle timeout you choose, or when you lock it by hand — and asks for the passphrase again before it will fill anything.

Passwords and cards live in the same vault and share the one passphrase. Setting it up under Passwords unlocks both.

Saved logins — the 🔑 button

Save as you go. When you sign in to a site, Chervil offers to save the login. You can also add one by hand in Settings → Security → Passwords, and generate a strong password there.
Fill with one click. On a site where you have a saved login, click the 🔑 button in the address bar, pick the login if there's more than one, and Chervil fills the username and password. It never submits — you review and sign in yourself.
Logins are matched to the site's domain, so a saved GitHub login is only offered on GitHub.
Manage them like a password manager. In Settings → Security → Passwords you can search your logins (handy after importing hundreds), reveal or copy a password to the clipboard, and edit a login in place — change the username or set a new password without deleting and re-adding it. Cards can be revealed and copied the same way.

Payment cards — the 💳 button

Save cards to check out faster, with the same protection as your passwords.

Add a card in Settings → Security → Payment cards: the name on the card, the number, and the expiry. Numbers are validated (Luhn) on save. You can add a label like "Personal" to tell cards apart.
Fill at checkout. On a payment form, click the 💳 button, pick a card, and Chervil fills the cardholder name, number, and expiry — handling combined MM / YY fields as well as separate month/year inputs and dropdowns.
The security code (CVC) is never stored. You type it yourself at checkout. This is deliberate — it's the card-network best practice and keeps the most sensitive digit out of the vault entirely.
Chervil never auto-submits a payment. It fills the fields; you review the order and pay yourself.

Card listings only ever show the brand and last four digits (e.g. Visa ····1234). The full number is decrypted only for a reveal in Settings or the moment it takes to fill a form — never logged, and never placed in a prompt to Sprig or any AI model.

Show or hide the fill buttons

Don't want the 🔑 or 💳 buttons in your address bar? Turn either off in Settings → Security — the toggles sit right under the Passwords and Payment cards sections. They're shown by default, and only appear on real sites when you actually have something saved to fill.

What Chervil never does

Never shows your passwords or card numbers to Sprig or any model.
Never submits a login form or a payment — you always do that yourself.
Never stores a card's CVC/security code.
Never writes any of this to the plaintext settings or session files — only to the encrypted vault.