2FA Authenticator

Fast, offline 2FA codes in your browser — TOTP two-factor authentication. Quick import from Google Authenticator.

2FA Authenticator: your two-factor codes, in the tab you are already in Stop reaching for your phone every time you sign in. Unlock it, find the app, scroll to the right account, read six digits, type them before they expire — that is fifteen seconds, several times a day, for something your browser can do in one click. This extension generates the same codes, from the same standard — the ones you have in Google Authenticator today — right where you are logging in. Free, open source, and no account to sign up for. ⚡ YOUR 2FA CODES WITHOUT PICKING UP YOUR PHONE 🚀 Click the toolbar icon and every 2FA code is there 🚀 One more click copies the one-time password — paste it and you are in 🚀 The account for the site you are on is suggested first, so you are not hunting through a list 🚀 Search as you type, even with a hundred 2FA accounts 🚀 A ring on each verification code shows how long it has left, so you never paste one that is about to expire 🚀 Your 2FA codes work offline — on a plane, on the underground, on a laptop with no signal 📲 BRING EVERY 2FA ACCOUNT OVER IN ONE SCAN 🔄 Already using Google Authenticator? Open it → menu → Transfer accounts → Export accounts 🔄 Pick the accounts and it shows a single QR code holding all of them 🔄 Scan it with your webcam, or upload a photo of it — the whole list crosses over at once 🔄 One export QR carries your whole Google Authenticator list, not one account at a time 🔄 Names, issuers, digits and periods come with them; nothing to retype 🔄 Your phone keeps its copy, so nothing is lost and you can run both while you decide 🌍 The same works for Authy, Microsoft Authenticator, 1Password, or any other authenticator app with a standard TOTP QR code 🔐 OPTIONAL PASSWORD PROTECTION FOR YOUR 2FA CODES 🔒 Off by default — turn it on in Settings whenever you want 🔒 Your codes are then encrypted on your device with AES-256-GCM, behind 600,000 PBKDF2 iterations 🔒 Turning it on removes every readable copy of your 2FA data: local storage, sync, and all seven backups 🔒 A recovery code means a forgotten password never costs you your accounts 🔒 Choose when to be asked: every time, after a few idle minutes, or once per browser session 🛡️ WHY THIS 2FA EXTENSION IS SAFE TO TRUST ✅ Open source — the code that generates your codes is public and readable ✅ Reproducible build — every release publishes a SHA-256 for every file, so you can rebuild it and check ✅ Manifest V3, with two Chrome permissions: storage and activeTab — and no host permissions ✅ No content scripts at all, so nothing of this extension ever runs on a page you visit ✅ No analytics, no tracking, no sign-up, no ads ✅ Your secrets are generated and kept on your machine — there is no account to create and no server to trust ✅ Free, with no paid tier, no trial and nothing to upgrade to ✅ A published security policy and a real address to report to 🎨 BUILT FOR EVERYDAY 2FA USE 🔑 Groups keep a long 2FA list navigable — filter by the labels above it 🔑 Rename any account, or set its issuer, so a cryptic label from a QR code becomes something you recognise 🔑 Drag to reorder, so your most-used accounts sit at the top 🔑 Compact and hidden view modes when you want more on screen or fewer codes on display 🔑 Three window sizes and dark mode 🔑 20 languages ⏰ 2FA CODE REJECTED? IT IS ALMOST ALWAYS YOUR CLOCK 🕒 Time-based 2FA codes fail when your computer's clock drifts more than about 30 seconds 🕒 The extension checks, tells you, and corrects for the difference so your codes keep working while you fix it 🕒 And it explains how to fix the clock itself — the same drift breaks Google Authenticator on a phone for exactly the same reason ➕ ADDING 2FA ACCOUNTS 📷 Scan a QR code with your camera 📷 Upload a screenshot, or capture one straight from your screen ⌨️ Or type the secret key by hand, for services that never show a QR code 🌍 Works with your bank, your work login — anything issuing standard TOTP ⚙️ Unusual setups are covered: SHA-1, SHA-256 and SHA-512, six or eight digit OTP, and a refresh interval other than the usual 30 seconds 💾 2FA BACKUPS, EXPORT AND SYNC 📦 Automatic local backups of your 2FA accounts, the last seven kept 📦 Export to a file — plain, or encrypted with a password you choose 📦 The same file imports back here, or into anything else that reads the format — the openness that let you leave Google Authenticator works in both directions 📦 Optional 2FA sync across your Chrome browsers through your own Google account. Switch it off and it is removed from Google's servers, not merely stopped 🌐 ABOUT THE NETWORK The extension sends nothing about you anywhere, because it holds nothing to send. It does check your clock against a public time API when you open it, so it can warn you about drift, and that check is cached. Opening help or the feature board opens an ordinary browser tab. That is the whole list, and it is documented alongside the code. ❓ COMMON QUESTIONS ABOUT 2FA AUTHENTICATOR Is this made by Google? No. It is an independent open-source project with no affiliation to Google. Why not just use the phone app? 2FA Authenticator runs where you actually sign in. Google Authenticator has no desktop version, so every sign-in on a computer means picking up your phone. The codes here are identical — same TOTP standard, same six digits — and they are already in front of you. Can I keep both? Yes. Importing copies your accounts across; Google Authenticator keeps its own, and nothing is removed from your phone. Does it work offline? Yes. Your 2FA codes are computed from your clock and your keys. Nothing needs a connection. What if I lose my computer? Export a 2FA backup and keep it somewhere safe. Your services' own recovery codes still work too. 🔐 NEW TO TWO-FACTOR AUTHENTICATION? A password can be guessed, reused, phished or leaked in someone else's breach. Two-factor authentication — 2FA, also called two-step or 2-step verification — adds a second thing that changes every 30 seconds and exists only on a device you hold, so a stolen password on its own is no longer enough to get in. Turn it on in your account's security settings, scan the QR code it shows you, and you are done — this 2FA extension is the part that produces the code from then on. 📖 READ MORE BEFORE YOU INSTALL How it works, in full detail — cryptography, storage, threat model, permissions: https://www.authenticator.sh/how-it-works Questions and answers, in your language: https://www.authenticator.sh/faq Security policy and how to report a vulnerability: https://www.authenticator.sh/security Help and support: https://www.authenticator.sh/support Source code: https://github.com/authenticator-sh/2fa 2FA Authenticator — your codes, on your device, one click from where you need them. Not affiliated with, endorsed by, or sponsored by Google. "Google Authenticator" is a trademark of Google LLC, named here only to describe importing and compatibility.