Saving and Filling Passwords in Overlay
Overlay can now remember a site's login when you sign in, and offer it back the next time you click into that site's login form. Everything stays on your Mac, encrypted, and nothing is typed into a page until you pick it. Here is how it behaves day to day, and where the switches are if you want to change something.
Saving
Sign in the way you always do. Once the login has gone through, a small card shows up in the top-right corner of the page asking whether to save the password, with the site and the username it picked up. Save stores it. Not now hides the card for this site and account until you restart Overlay. Never puts the site on a never-save list, which you can edit later in the manager.
The card waits for the login to actually succeed. Mistype your password and get bounced back to the form, and nothing appears, which is the point: a wrong password shouldn't end up saved. On sites that don't reload the page, the card appears when the password field goes away.
Sometimes Overlay can't work out which box was the username. The card then leaves the username editable so you can type it in. You can also save with no username at all, for the handful of sites that only ask for a password.
If the page is plain HTTP, the card says so. You can still save, but Overlay won't offer a password saved over HTTPS on an HTTP page, ever.
Filling
Click into the username or password box on a site you've saved. A dropdown opens right under the box with one row per saved account: the username, and a row of dots for the password underneath. If a row was saved on a different subdomain of the same site, that host is shown on the right.
Click a row or use the arrow keys and Return, and the fields are filled and the cursor moves to the password. Typing narrows the list by username. Esc closes the dropdown for that box; Tab closes it and moves on. The last row, Manage passwords…, opens the manager.
Overlay never fills on its own. One saved account still means a one-row dropdown that you click.
Logins that live inside an embedded frame from another domain work too. That is how Apple's own sign-in and a lot of corporate single sign-on pages are built, and it took a while to get right.
When a password changes
Sign in with a username Overlay already knows and a different password, and the card asks to update rather than saving a second copy. Same username, same password, and nothing appears; Overlay just notes that you used it.
You will get two entries for the same account when the site looks like two sites to Overlay: a
form on login.example.com and another on app.example.com, or the same account typed once as
an email and once as a phone number. That's deliberate. If it's wrong for your case, delete the
extra one in the manager.
The manager
Settings › Passwords has two switches (offer to save, autofill) and a Manage… button. The button opens a separate window with the list, because with a few hundred entries it doesn't belong on the settings page.
In that window you can search by site or username, click an entry to expand it and edit the username, reveal or copy the password, or delete it. Select turns on checkboxes for deleting a batch. Import… takes a CSV exported from Chrome, Edge, Safari, Firefox, Bitwarden or 1Password; before anything is written you're shown how many entries are new, how many already exist, and whether existing ones should be skipped or replaced. Delete the CSV afterwards, it's plain text. The never-save list is here too, each entry with a remove button, and Reset password vault at the bottom deletes everything on this Mac after asking for authentication and a confirmation.
What Touch ID is for
Revealing or copying a password asks for Touch ID, or your login password on a Mac without it. After that you're left alone for five minutes. Copied passwords are cleared from the clipboard after a minute unless you've copied something else in between.
There's a third switch, Authenticate before filling. With it on, picking an account in the dropdown asks for Touch ID first, with the same five-minute grace. It's on by default on Macs with Touch ID and off on Macs without, where a password prompt on every login gets old fast. If other people can get at your Mac while it's unlocked, turn it on.
Where things are stored
One encrypted file in Overlay's own folder, with the key that unlocks it in your login Keychain. Nothing is uploaded and nothing syncs between Macs. The privacy policy lists everything that leaves your machine; passwords aren't on the list.
Tabs with an isolated session (their own cookies, for being signed into one site as two people) share the same saved passwords. A password belongs to the site, not to the cookie jar.
Backup is Time Machine. Restore the same user account and the Keychain, and with it the key, comes back next to the file.
There's no export to CSV, on purpose. An export wouldn't stop anyone who can already pass Touch ID on your Mac, and it would leave a plaintext file of every password behind. If portable backup comes later it'll be encrypted with a passphrase you choose.
If something's off
The save card never shows: check that Offer to save is on, that the site isn't on the never-save list, and that the login really went through. Some sites leave the login form on the page after a successful sign-in, and Overlay reads that as a failure.
It saved a second entry instead of updating: the form came from a different subdomain than the one you saved on, or the username was captured in a different form. Delete the one you don't want.
The dropdown doesn't open: Overlay only opens it on fields it recognises as part of a login form, and only when you clicked or tabbed into the field yourself. After Esc, click the field again.
A site hides the password and you want to see it: open the manager, pass Touch ID, reveal it there. Filling into a page never shows it.
Generated passwords for sign-up forms aren't there yet. Whatever you type on a sign-up form can be saved; suggesting one is on the list.
If you're curious how this was built and why it behaves the way it does, there's a longer write-up: Adding password autofill to a WKWebView app.