How to let an AI agent log in to websites without your password
Don’t give it the password. Give it a browser that’s already signed in. There are four ways to do that, and the simplest is the browser you use every day.
Why not just paste the password?
Because it doesn’t stay in one place. Kernel, which sells sign-ins for agents, lists where it ends up: credentials “may also appear in prompts, tool arguments, traces, or application logs.” Browser Use’s docs put it in one line: “Never put passwords or TOTP secrets directly in a prompt.”
And a password is rarely enough anyway. The two-factor code goes to your phone, and your company’s single sign-on wants you, not a bot.
1. Your own signed-in Chrome
Your agent works in the browser you’re already signed in to. Two-factor is done, single sign-on is done, and nothing gets copied anywhere. The agent never sees a password because it never has to log in.
- Tabhand gives any MCP agent (Claude Code, Codex, Cursor, OpenCode and 15 more) tabs of its own in your Chrome, in the background.
- Claude in Chrome, for Claude on a paid plan, “shares your browser’s login state”, and when it meets a login page, “it pauses and asks you to handle it manually.”
- Playwright MCP’s extension connects Playwright to tabs in your running Chrome or Edge.
Best for: coding agents on your own computer, in your own accounts. Watch for: an agent signed in as you can act as you. More on that below.
2. A separate profile you sign in to once
Playwright MCP and Chrome DevTools MCP open a browser with a profile of their own, and keep it between runs. In Playwright’s words: “All the logged in information will be stored in the persistent profile.”
You sign in to each site again inside that profile, two-factor and all. Some sites won’t let you: Chrome DevTools MCP’s docs warn that “some accounts may prevent sign-in when the browser is controlled via WebDriver.” And a profile serves one browser at a time, so two agents can’t share it.
Best for: a few test accounts, or a clean browser you want kept apart from your own.
3. A saved session file
Playwright can save a signed-in session to a file and load it later with --storage-state. Browser Use can sync your cookies into its cloud browsers.
Both are copies of your logins, and both go stale. Playwright’s docs say the file “may contain sensitive cookies and headers that could be used to impersonate you”, and that “you need to delete the stored state when it expires.” Browser Use warns that sites can “bind sessions to a device or network”, so a copied login may simply be refused.
Best for: automated tests that need a signed-in state, in CI.
4. A login service in the cloud
Kernel and Browserbase run browsers in their cloud and keep the logins there:
- Kernel’s managed auth signs in through a page it hosts, and says credentials are “never exposed in API responses or passed to LLMs.” It can fill authenticator codes if you give it the secret, but email and SMS codes need you. The free plan covers three sites.
- Browserbase’s Contexts save a browser’s cookies, encrypted, after you sign in once through a live view. Both work with 1Password for filling passwords.
Best for: products whose agents sign in on behalf of many users.
Which one?
In all four, the agent never sees your password. Where they differ:
| Two-factor and single sign-on | Work per site | Your session lives | |
|---|---|---|---|
| Your signed-in Chrome | Already done | None | On your computer |
| A separate profile | You do it again | Sign in again | On your computer |
| A saved session file | Done once, then expires | Save the file | In a file |
| A cloud login service | Authenticator codes only | Connect each site | In their cloud |
For agents on your own computer, the first is the least work and copies nothing. The others earn their keep when the agent runs somewhere else.
Keep a signed-in agent on a short leash
Kernel’s own guide makes the point well: “Credential isolation limits what leaks; it does not by itself limit what the agent can do.” Keeping the password out of the prompt is half the job. The other half is limiting what the agent can reach.
That’s how Tabhand is built:
- It reaches only its own tabs. An agent can use the tabs it opened and pages those open. Yours stay off limits.
- One click stops it. The Tabhand icon in Chrome’s toolbar pauses every agent at once.
- It asks first. Tabhand tells agents to check with you before they send, post, buy, delete or change a setting.
Questions
Can Claude Code log in to websites? It doesn’t need to. With Tabhand, Claude Code works in your Chrome, where you’re already signed in. The Claude Code guide takes two minutes.
What about sites with two-factor? In your own Chrome, you’ve already done it, and the agent uses the session you have. When a site asks again, you answer it, the same as always.
Does Tabhand see my passwords? No. It never touches your saved passwords, and it sends nothing anywhere: no servers, no accounts, no telemetry.
Let your agent use your Chrome
npx tabhand setupFree and open source, for macOS and Google Chrome. Works with Claude Code, Codex, Cursor and 16 more.
Checked on October 27, 2026 against Playwright’s authentication docs, Playwright MCP and its extension, Chrome DevTools MCP, Claude Code’s Chrome docs, Kernel’s managed auth and agent identity guide, Browserbase’s Contexts and 1Password docs, and Browser Use’s 2FA and profile sync docs. If something here is out of date, tell us.