From a0e2395c84849372f22b33a6da32ab0c1c7306ed Mon Sep 17 00:00:00 2001
From: varjolintu <sami.vanttinen@varjolintu.fi>
Date: Sat, 7 Feb 2026 09:43:53 +0200
Subject: [PATCH] Fix PayPal password input detection

---
 keepassxc-browser/common/sites.js            | 26 +++++++++++++++++++-
 keepassxc-browser/content/fields.js          |  7 ++----
 keepassxc-browser/content/observer-helper.js |  5 ++--
 3 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/keepassxc-browser/common/sites.js b/keepassxc-browser/common/sites.js
index e2e0119..c6081dd 100644
--- a/keepassxc-browser/common/sites.js
+++ b/keepassxc-browser/common/sites.js
@@ -110,7 +110,31 @@ kpxcSites.exceptionFound = function(identifier, field) {
         return true;
     } else if (document.location.origin === 'https://www.epicgames.com'
         && ((field?.style?.opacity === '1' && field?.style?.willChange === 'auto') || identifier === 'password')) {
-            return true;
+        return true;
+    } else if (document.location.origin === 'https://www.paypal.com' && field?.id === 'splitPassword') {
+        return true;
+    }
+
+    return false;
+};
+
+// Handles exceptions when returning or modifying existing combinations
+kpxcSites.combinationExceptionFound = function(existingCombination) {
+    if (!existingCombination) {
+        return false;
+    }
+
+    // Exception for e.g. Google. They replace the username input with password input using identical className.
+    // If detected, remove the username from the combination.
+    if (existingCombination?.username?.className?.length > 0
+        && existingCombination?.password?.className?.length > 0
+        && existingCombination?.username?.className === existingCombination?.password?.className) {
+        return true;
+    }
+
+    if (document.location.origin === 'https://www.paypal.com'
+        && existingCombination.password?.className?.includes('pin-password')) {
+        return true;
     }
 
     return false;
diff --git a/keepassxc-browser/content/fields.js b/keepassxc-browser/content/fields.js
index 5c00cd0..8465e89 100644
--- a/keepassxc-browser/content/fields.js
+++ b/keepassxc-browser/content/fields.js
@@ -108,11 +108,8 @@ kpxcFields.getExistingCombination = function(combination) {
             existingCombination.passwordInputs.push(combination.password);
         }
 
-        // Exception for Google. They replace the username input with password input using identical className.
-        // If detected, remove the username from the combination.
-        if (existingCombination?.username?.className?.length > 0
-            && existingCombination?.password?.className?.length > 0
-            && existingCombination?.username?.className === existingCombination?.password?.className) {
+        // Remove username field from combination with certain sites (replaced by password input)
+        if (kpxcSites.combinationExceptionFound(existingCombination)) {
             existingCombination.username = null;
         }
 
diff --git a/keepassxc-browser/content/observer-helper.js b/keepassxc-browser/content/observer-helper.js
index 077b7db..afd3aed 100644
--- a/keepassxc-browser/content/observer-helper.js
+++ b/keepassxc-browser/content/observer-helper.js
@@ -247,8 +247,9 @@ kpxcObserverHelper.findInputsFromShadowDOM = function(target) {
 
 // Detects animations and transitions. Triggers handleObserverAdd() again on animationend/transitionend.
 kpxcObserverHelper.handleTransitions = function(target) {
-    const targetHasAnimations = target?.classList?.toString()?.includes('animate');
-    const targetHasDurations = target?.classList?.toString()?.includes('duration');
+    const classList = target?.classList?.toString();
+    const targetHasAnimations = classList?.includes('animate');
+    const targetHasDurations = classList?.includes('duration') || classList?.includes('transform');
 
     if (targetHasAnimations || targetHasDurations) {
         const animations = target.getAnimations();