FakeForm

ProNewv1.0.2

Fill any form with believable fake data — in one keypress, and undo it

FakeForm is a Pro app

It needs a free KimtOS account and a Pro subscription. Everything still runs on your device — Pro unlocks the app, it does not send your data anywhere. Install it without Pro and the app opens to an upgrade wall. See what Pro includes

Overview

FakeForm fills a form with believable fake data in one keypress, so you can test it without typing "test test test" into forty boxes. Press the shortcut on a signup page and it works out what each field is asking for — a name, an e-mail, a postcode, a card number, a date of birth — and writes something that looks like a real answer. It is part of the kimtos new-tab app suite.

Everything is invented on your device. FakeForm has no dataset to download and no service to call: it generates every value in your browser, on the spot. That is not a compromise we worked for — a form filler is local by nature. It makes data up; there is nothing for it to fetch.

FakeForm is a Pro app. Its badge, its shortcuts and its right-click menu only exist when the app is installed and the account is entitled to it.

This app is under active development. This booklet describes what the code currently supports.

Highlights

• Three actions — fill the form you are in, fill only the field you are in, or fill every field on the page, across forms.
• Undo — one action puts every field back exactly as it was, including checkboxes, radio buttons and dropdowns. Nothing FakeForm does is one-way.
• It works on React, Vue and Angular apps — the values are written the way the browser writes them, so the framework behind the page actually receives them and the form submits with real data in it.
• Believable, not random — one person per fill. The first name, the surname, the full name, the username and the e-mail on a form all belong to the same invented human, so a filled form reads like a filled form.
• Safe to submit — e-mail addresses use the reserved example.com family and phone numbers the 555-01xx range set aside for fiction, so a test submission cannot reach a real stranger.
• It knows what to leave alone — CAPTCHAs, hidden fields, disabled and read-only fields and file pickers are never touched.
• Passwords are filled, and the one it used is shown to you, so you can log back in as the account you just created.
• Nothing is stored. FakeForm has no history, no saved profiles and no settings. The data it invents is typed into the page and forgotten.

What it is not

FakeForm does not remember anything. There is no list of past fills, no saved "personas", and nothing of yours in the shared database — which is why it does not appear in AnubisDB. Every fill starts from nothing.

It also does not sync anything between browsers, because there is nothing to sync. The reference product sells cross-browser settings sync as its headline paid feature; that is a server, and this app has no configuration to put on one.

Getting started

Turn it on

1. Install FakeForm from the App Store (top right of the new tab). It is a Pro app, so it needs a Pro plan or an access code that includes it.
2. Open FakeForm and press Allow on all sites. FakeForm has to run on the pages you are testing, and the browser will only let it once you say so. It asks for nothing else — no history, no downloads, no network access.
3. Open any page with a form on it.

The four actions

Action	What it fills
Fill this form	Every field in the form around whatever you last clicked into.
Fill this input	Only the field you are in.
Fill everything	Every field on the page, across every form on it.
Undo the last fill	Puts every field the last fill touched back exactly as it was.

Each one is available three ways, and they all do the same thing:

• A keyboard shortcut. "Fill this form" is Alt+Shift+F and "Undo" is Alt+Shift+Z out of the box. The other two start unassigned. Set or change any of them at chrome://extensions/shortcuts.
• The badge. Click into any text field and a small FakeForm button appears in the corner of it, next to Grammit's and Clipboard's if you have those. Click it for a menu of all four actions. Drag it if it is in your way — it stays where you put it.
• The right-click menu. Right-click anywhere on the page and pick an action from the FakeForm submenu.

Reading the result

A short message appears in the bottom-right corner saying how many fields were filled. If one of them was a password, it is shown in that message — copy it if you want to sign back in as the account you just made. It is shown once and never stored.

What it fills, and with what

FakeForm works out each field's meaning from what the page tells it: the type of the input first, then the autocomplete value, then the words the page uses around the field — its name, its id, its placeholder, its label. Punctuation does not matter, so user_name, user-name and userName are all understood as the same thing.

A few worth knowing about:

• Dropdowns and radio buttons get one of the choices the page already offers — never invented text, and never the "Please select…" placeholder.
• Checkboxes are ticked about two times in three, except a required one (a terms-and-conditions box), which is always ticked so the form will submit.
• Numbers, dates and ranges stay inside the min, max and step the page declares, and long values are cut to the field's maxlength — so what FakeForm writes passes the form's own validation.
• Card numbers pass the standard checksum, so a payment form accepts the shape. It is not a real card and no bank will authorise it.

What it never touches

CAPTCHAs, hidden fields, disabled fields, read-only fields and file pickers. A CAPTCHA exists precisely so that a program does not answer it, and a hidden field usually carries a security token that filling would break.

Undo, and what it means

FakeForm overwrites what is already in a field. That is the job — you invoked it on purpose — and Undo is what makes it safe: it restores every field the last fill touched, to the exact value it had, through the same path it used to write. Undo covers the most recent fill; once the page is reloaded there is nothing left to undo, because FakeForm keeps nothing.

Architecture

FakeForm is split across four places, and the split is the design.

Piece	Where	What it does
The app window	apps/fakeform/index.ts	Turns it on, lists the shortcuts, and runs a live demo form.
The badge	content/fakeform.ts	One small control on the page. Waits for a click. Nothing else.
The filler	content/fakeformFill.ts	The detector, the generators and the data. Injected on demand.
The gate and the wiring	background/fakeform.ts	Checks entitlement, injects the filler, forwards the action.

Two scripts, not one

A control the user can see on any site has to be paid for on every page load. A form filler, unlike a clipboard watcher or a writing assistant, is not watching anything — it acts only when asked. So the two halves are separated:

• The badge is always on wherever the app is installed and permitted, and it is deliberately tiny. It carries no detector, no generators and no name data. All it can do is draw itself and send a message.
• The filler is injected on demand. When the badge, a keyboard shortcut or a right-click item asks for a fill, the service worker injects the filler into that tab and tells it what to do. A page you never fill never loads it.

Both bundles are single self-contained files. An extension content script cannot fetch a sibling chunk at runtime, so a split bundle would break silently on every page; the build asserts it.

The pure core

The parts worth being sure about have no DOM in them at all:

• lib/fakeform/detect.ts decides what a field is asking for, from a plain description of it. The type attribute wins, then autocomplete, then a first-match-wins table of word rules over the field's name, id, placeholder, ARIA label and <label> text — with class consulted only as a last resort, because a class list is mostly framework noise.
• lib/fakeform/values.ts turns a kind into a value, honouring the field's own maxlength, min, max and step.
• lib/fakeData.ts is the generator itself — names, addresses, phone numbers, passwords, card numbers, lorem text. Every generator is seeded, so the same seed produces the same person; that is what makes the whole thing testable rather than only inspectable. DevTools' Lorem ipsum and UUID tools come from here too.

Only lib/fakeform/fill.ts touches the page.

Writing so the page notices

Setting input.value does not update React, Vue or Angular. React puts a value tracker on the element that shadows the prototype's setter, so assigning through it updates the tracker as well; React then compares old and new, sees no change, and never fires its onChange. Its state stays empty and the form submits empty — while the text sits there in the box, looking correct.

So every write goes through the prototype's native setter, which leaves the tracker stale, and is followed by real bubbling input and change events. Checkboxes and radio buttons are set with a real click(), so the page's own activation behaviour runs and a radio group's siblings clear correctly.

Undo uses the same path in reverse, which is why restoring a value is as visible to the page as setting one was.

Storage

There is none. FakeForm writes nothing to the shared database, nothing to chrome.storage, and has no settings schema — which is why it does not appear in AnubisDB. Convention 6 is satisfied by having no data at all, which for a tool is the right answer rather than a loophole.

The one exception is not FakeForm's: the badge remembers where you dragged it, in a position shared with Grammit's and Clipboard's badges.

The gate

FakeForm is a Pro app, so every entry point is gated through the one shared rule in lib/entitlementCore.ts — the badge, the shortcuts, the right-click items, the service worker's inject step, and the filler itself at the moment of the fill. The badge subscribes rather than reading once, so it appears the moment the app is installed or the account upgraded, and disappears the moment either goes away, without a reload.

This is a product gate, not a security boundary. The extension is on your own disk; anyone willing to edit the bundle can bypass any check in it. The gate exists so the app behaves correctly, which is all a check on the user's own machine can ever do.

Changelog

1.0.2 — 2026-07-27

• Make the in-page surfaces follow the Appearance setting

1.0.1 — 2026-07-26

• The in-page menu follows your Appearance setting instead of always being dark, so it no longer hangs off a light page as a dark popover.

1.0.0 — 2026-07-23

• Initial release. Fill the form you are in, the field you are in, or every field on the page, from a keyboard shortcut, the right-click menu, or a badge in the focused field — and undo it.