TextExpander and Secure Input

How TextExpander Works

TextExpander expands snippets in response to what you type. But when you are typing a password or entering other sensitive information, a feature called Secure Input ensures that TextExpander—along with other applications—can't see what you're typing.

Normally, Secure Input is a good thing; you wouldn't want TextExpander or any other applications to see your passwords. Secure Input is usually turned off as soon as you leave the password field or sensitive information area. But sometimes Secure Input will stay enabled even after you are finished typing sensitive information. In such cases, TextExpander will stop functioning until Secure Input is disabled.

How Secure Input Can Cause a Problem

As you type characters on your keyboard, they pass through parts of OS X and are usually handed to the active application. There, they will appear on the screen as parts of words, or they might be treated as commands, or they'll be handled some other way. Applications such as TextExpander can register to see characters that you type, and even modify them, before the active application receives them. This observation of your typing is called key logging, and it is how TextExpander knows that you have typed an abbreviation that should be expanded into its snippet.

Any application can prevent key logging by enabling Secure Input. With Secure Input enabled, all typing is passed directly to the active application—no other applications can observe your typing. This way, Secure Input ensures that no malicious key-logging software or “spy-ware” will be able to see your sensitive data. Secure Input is generally enabled when you type into a password field (). Some applications also enable Secure Input at other times, which is appropriate as long as they turn Secure Input off once it is no longer required. Apple has published a technical note which specifies how and when Secure Input should be turned on and off.

How to Fix It

Unfortunately, there are a few situations where Secure Input is left in its “enabled” state when it should not be—when you have finished entering sensitive information, or when you have begun to use a different application than the one that turned on Secure Input. In these cases, you will not be able to use TextExpander until Secure Input is disabled. So how can you disable Secure Input?

TextExpander will let you know when Secure Input is enabled by updating its menu bar to indicate that expansion is disabled. If the application enabling Secure Input is not the current application, TextExpander adds a “caution” symbol to its menu bar icon and Dock icon. (TextExpander checks Secure Input status about every 15 seconds, so the icon display may lag a bit behind the actual state.) While the menu icon displays as disabled, the “Expansion Disabled (app name)” menu item indicates which application appears to have enabled Secure Input. Quitting that application will disable Secure Input.

However, depending on the individual application, there may be other ways to avoid this problem. If you've having trouble with an app enabling "Secure Input" or getting the "Expansion Disabled" message, check to see if the app you're having trouble with is listed here. If it's not, please let us know and we will investigate.

Known Issues by Application

• 1Password
• LastPass
• Google Chrome
• Firefox
• Hulu Desktop
• iFinance
• Quicken Scheduler
• Notational Velocity
• Chronories
• Terminal
• loginwindow

1Password

On Mac OS X 10.8 Mountain Lion, 1Password will enable Secure Input mode while it's hidden. This will happen when choosing the "Hide 1Password" menu option or choosing "Hide Others" when 1Password is running. Minimizing 1Password or leaving it visible in the background will not cause this problem. The 1Password team is already working on a fix for this issue; read their analysis for more details.

LastPass

LastPass will currently enable Secure Input on Google Chrome as long as you are logged in to LastPass. There's a fix for this in the works; upgrading to the latest prebuild of LastPass will resolve the issue, and that solution should be coming to the release version of LastPass soon. In the meantime, this forum post on the topic sheds a bit of light on this issue.

Google Chrome

Chrome sometimes fails to turn Secure Input back off after typing in a password field, particularly if the cursor is still in a password field when the password is submitted. If you find a specific sequence of events that causes this problem, please let us know, and let the Google Chrome team know so they can reevaluate this behavior.

Firefox

If you encounter trouble with Firefox, please update to the latest version; older versions of Firefox had a bug which could cause Secure Input to remain enabled incorrectly.

Fluid

Fluid enables Secure Input and never disables it when a password field is focused while submitting a form. Focusing on another field or removing the focus works around the issue. The Fluid author is aware of the problem and hopes to fix it in a future update.

Hulu Desktop

Hulu Desktop currently enables Secure Input as soon as it is launched, and leaves it enabled until you quit. Your television viewing habits are probably not a secret! We encourage you to contact Hulu so they can fix this.

iFinance

iFinance enables Secure Input at launch and never disables it. You might offer feedback to the developer that this is not how to use Secure Input properly.

Quicken Scheduler

This application automates acquisition of financial data for Quicken. For some reason, it enables Secure Input. You can run the Activity Monitor utility and quit Quicken Scheduler, or if you disable all "Scheduled Updates" in Quicken, Quicken Scheduler will quit.

Notational Velocity

The Notes portion of Notational Velocity's preferences has an option for “Secure Text Entry.” This enables Secure Input while editing within Notational Velocity. Turn this off to permit the use of TextExpander within Notational Velocity. Newer versions only enable Secure Input while Notational Velocity is active, but older versions left Secure Input on until you Quit.

Chronories

Chronories enables Secure Input whenever it is active, but expansion is disabled only within Chronories. We don't know if there is an option to turn this off.

Terminal

Terminal has a “Secure Keyboard Entry” menu item so you can turn Secure Input on and off within Terminal. You should probably enable this when entering passwords. Turn it off again afterwards to enable TextExpander expansion.

Other terminal applications such as iTerm2 have similar settings.

loginwindow

When TextExpander tells you the name of the application that has enabled secure input, it's giving you a “best guess” that's sometimes inaccurate. When TextExpander reports that “loginwindow” has enabled secure input, it's likely that TextExpander can't quite tell which application has enabled secure input, so instead it's showing that application's “ancestor, ” loginwindow. This can also happen when OS X itself has left secure input enabled after you've logged in, or after you've entered your password to wake the computer from sleep or from screensaver.