Automating form filling with AI, without handing over your passwords

2 September 2026 · 10 min read · by Akhil Gorantala

Forms are where browser drudgery concentrates: shipping addresses, job applications, expense reports, the same twelve fields on every government portal. AI can genuinely take this over now, but the tools differ wildly in how they do it and what they get to see while doing it. Here is how the approaches compare, the setup for the one we build, and the fields no tool should ever touch.

Three ways AI fills a form

Cloud browser agents (the Operator style) run a browser in a datacenter, look at screenshots, and type into fields there. They work, slowly, and the entire form session happens on someone else's machine, which is exactly where you do not want your home address and date of birth.

Screenshot agents in your browser (Claude in Chrome and similar) act locally but still send a screenshot of the page, your half-filled form included, to a vision model for every action. Each field is a round-trip of a second or two, and each round-trip carries a picture of everything on screen.

Local element finding, Dowser's approach: your assistant says "fill the street address field with 12 Elm St" and a ranker inside the extension finds that field on the page's accessibility tree, on your machine, in a few milliseconds. The model never sees the page unless it explicitly asks to read something; it just names fields the way a person would. The engine difference across the whole category is mapped in the tool comparison.

The setup

Paste this into Claude Code, Cursor, or any MCP assistant:

Set up the Dowser browser extension for me: fetch https://dowser.click/install.md and follow the steps in it, then confirm Dowser is connected.

Two minutes, one Add to Chrome click from you, and a 5-day trial starts, no card. The step-by-step version with guardrails explained is in the Claude Code walkthrough; the Cursor equivalent is here.

A worked example

You are on a checkout page. You say:

Fill in my details on this checkout: Jane Doe, jane@example.com, 12 Elm St, Springfield CT 06101, phone 555 0100. Pick standard shipping. Stop before payment.

The assistant issues one dowser_act fill per field: full name, email, street, city, state (a dropdown, so it selects by label), ZIP, phone; then clicks the standard-shipping radio button. Each action lands in a few milliseconds under a visible cursor, and each is a sentence-sized tool call, so the whole form costs less context than a single screenshot would. At the payment block it stops, by rule, and tells you the card field is yours. If any label is ambiguous, say two fields both look like "name", it returns the candidates and asks instead of guessing.

The fields it will not touch, on purpose

Dowser refuses to fill password, card number and OTP fields, even when asked nicely. That is a hard rule in the extension, not a model preference. Payment details belong to your password manager and browser autofill, which are built and audited for exactly that job. The same guard applies to destructive buttons: anything that looks like pay, delete or transfer needs explicit confirmation before it gets clicked. A form tool that will type anything anywhere is a keylogger with a friendly interface; the refusal list is the feature.

Repetitive forms: the real win

The compounding value shows up on the tenth form, not the first. Tell your assistant once: "here are my standard details; whenever I say fill this form, use them." The assistant keeps that context and Dowser does the typing, so a job application or a conference registration becomes one sentence. Because finding is local and instant, a 15-field form costs about as much model time as a 2-field one; snapshot tools scale their cost with every field, since each fill means another screenshot through the model. Multiply by a job hunt's fifty applications and the two designs are not in the same sport.

The privacy line that actually matters

Ask one question of any form tool: when it fills a field, what has seen the page? With cloud agents, the vendor's datacenter has. With screenshot agents, the model provider has, one picture per action. With local finding, the answer is your own machine, full stop; the assistant knows only what it asked to read. For forms specifically, where the content is by definition your personal data, that line is worth choosing tools by. Dowser's site practices are documented plainly on the privacy page.

FAQ

Does it work on multi-step forms and dropdowns?

Yes. Selects take the option label ("choose Connecticut in the state dropdown"), and multi-page flows are just several instructions in a row, with the assistant reading each new page.

What about CAPTCHAs?

They are yours. Dowser does not solve or bypass them, and an assistant asking you to complete one is the system working as intended.

Can it fill PDFs or desktop apps?

No; it acts on web pages in a Chromium browser. Web-based PDF viewers with real form fields sometimes work, but native PDF forms and desktop apps are out of scope.

Autofill already does this; why bother?

Autofill knows your saved profiles; an assistant knows intent. "Use my work address here but my personal email" is one sentence to an assistant and a manual edit war with autofill. They also stack: let autofill do cards, the assistant everything else.

Which assistants does this work with?

Anything MCP: Claude Code, Cursor, Windsurf, Codex CLI, Gemini CLI. Setup guides for each are in the install guide.

What if the form is in another language?

The finder matches meaning, not exact strings, and works across languages; ask for "the postal code field" on a German checkout and it finds PLZ.