diff --git a/.gitignore b/.gitignore
index 7717d02..4e9efd2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,7 @@
 chromeipass.pem
 /chromeipass-data/
 .idea/
+
+*.sublime-workspace
+
+*.sublime-project
diff --git a/chromeipass/background/keepass.js b/chromeipass/background/keepass.js
index 12cafdf..968fa81 100644
--- a/chromeipass/background/keepass.js
+++ b/chromeipass/background/keepass.js
@@ -76,6 +76,18 @@ keepass.updateCredentials = function(callback, tab, entryId, username, password,
 }
 
 keepass.retrieveCredentials = function (callback, tab, url, submiturl, forceCallback, triggerUnlock) {
+
+	// if setting is active ask if password should be filled
+	if(page.settings.popupAutoFill){
+		var r = confirm("Should credentials for \n \n" + url + "\n \nbe retrived ?");
+		if (r == false) {
+			if(forceCallback) {
+				callback([]);
+			}
+		    return;
+		};
+	}
+
 	page.debug("keepass.retrieveCredentials(callback, {1}, {2}, {3}, {4})", tab.id, url, submiturl, forceCallback);
 
 	// unset error message
diff --git a/chromeipass/background/page.js b/chromeipass/background/page.js
index ce136bd..e2bc5d8 100644
--- a/chromeipass/background/page.js
+++ b/chromeipass/background/page.js
@@ -24,6 +24,9 @@ page.initSettings = function() {
 	if(!("autoFillSingleEntry" in page.settings)) {
 		page.settings.autoFillSingleEntry = 1;
 	}
+	if(!("popupAutoFill" in page.settings)) {
+		page.settings.popupAutoFill = false;
+	}
 	if(!("autoRetrieveCredentials" in page.settings)) {
 		page.settings.autoRetrieveCredentials = 1;
 	}
diff --git a/chromeipass/options/options.html b/chromeipass/options/options.html
index a0c200b..83d9656 100644
--- a/chromeipass/options/options.html
+++ b/chromeipass/options/options.html
@@ -201,6 +201,13 @@ <h2>General Settings</h2>
 					<span class="help-block">For all username fields on a page a dropdown list appears which contains all available credentials.</span>
 				</p>
 				<hr />
+				<p>
+					<label class="checkbox">
+						<input type="checkbox" name="popupAutoFill" value="0" /> Show Popup before retriving credentials.
+					</label>
+					<span class="help-block">Show a popup to confirm password autofilling. Protects against hidden inputs.</span>
+				</p>
+				<hr />
 				<p>
 					Check for updates of KeePassHttp:
 					<br />