Bitwarden’s Edge extension suggests a login when the saved item’s URI (website address) matches the current page. A suggestion is not proof that a site is legitimate. Check the domain in the address bar and the account name, then select a matching item yourself on a trusted page and review the filled values before submitting.

Check URI matching and manual fill first

Open a Bitwarden login item and confirm that its Website URI matches the actual sign-in site. Base domain is the default match detection, unless an organization or item setting changes it. This method compares the top-level and second-level domains; Bitwarden’s example says a saved google.com URI matches accounts.google.com. That can be convenient, but if a suggestion appears on an unfamiliar subdomain or a look-alike address, compare the address yourself instead of assuming the match proves the site is safe. If the site differs from the expected URI, stop rather than forcing credentials into it.

For a first check, selecting a matching item from the extension is easier to reason about than automatically filling a page as it loads. WIRED reviewer Scott Gilbertson describes using Bitwarden’s extension keyboard shortcut to fill a login. The shortcut and interface may change, so consult the current extension instructions. In any case, do not assume that autofill submits a form; inspect the account and address before submitting.

Bitwarden’s autofill-on-page-load option is off by default. Bitwarden warns that a compromised or untrusted site could abuse it to obtain credentials. Before enabling it for convenience, understand how URI matching applies and consider enabling it only for a small set of logins where you have checked the behavior. This is configuration guidance; it is not a claim that a particular attack was reproduced here.

Edge and Bitwarden vault timeout

In the extension settings, choose a vault timeout and an action such as Lock or Log out. Bitwarden measures “time passed” from your last interaction with Bitwarden, not from general computer inactivity. Closing one tab may not lock the browser extension. When checking a timeout, follow the condition you selected and observe whether the extension asks you to authenticate again after it locks.

For Bitwarden’s “On browser restart” timeout in Edge, Bitwarden says to turn off both Startup Boost and the setting to continue running background extensions and apps after Edge closes, under edge://settings/system. If Edge remains active in the background, closing it may not satisfy the restart condition. The Never option does not time out the vault; Bitwarden warns that it can store the encryption key unencrypted on the device.

Edge’s own autofill and what to do when it fails

If Edge also suggests saved passwords, identify which manager is offering to fill them. Edge’s password autofill and Bitwarden’s autofill are separate settings. If you choose Bitwarden as your password manager, you can follow Bitwarden’s guide to adjust Edge’s saving and autofill settings separately. On a work-managed browser, check with the administrator before changing policy.

If no item matches, check that the login has a URI and review the URI match method. If it still fails, the site may use a separate frame for its login fields or a form that does not follow the usual pattern. Do not submit if the address looks suspicious or the filled values are not what you expected. Menus and behavior can vary with Edge and extension versions, organization policy, and site design. These are documentation-based checks; no test with real credentials was performed.

Sources