AS Authenticator

Two-factor authenticator. TOTP and HOTP codes from an encrypted vault that never leaves your browser.

Two-factor authentication (2FA) for every site that offers it: an authenticator app for time-based one-time passwords (OTP, TOTP), counter-based codes (HOTP), Steam Guard and multi-factor (MFA) login codes, generated offline in your browser. A free, open-source alternative to Google Authenticator, Authy, Microsoft Authenticator, 2FAS and Aegis, with imports from all of them. No account, no cloud, no tracking. AS Authenticator generates two-factor codes in your browser and keeps the secrets in an encrypted vault that never leaves it. WHAT IT DOES • TOTP, HOTP and Steam Guard codes, with the account for the site you are on shown first. • One click copies a code; the bolt fills it straight into the login field, including split six-box forms. Keyboard shortcuts fill and scan without opening the popup. • Add accounts by dragging a box around the QR code on a page, scanning the whole page, using your camera, choosing an image, pasting a link, or typing a secret. A Google Authenticator export brings in every account at once, and Aegis, 2FAS and Bitwarden files import directly. • Brand icons for well-known services, or an icon of your own. Categories, pins, drag to reorder, search. HOW IT PROTECTS YOU • The vault is encrypted with AES-256-GCM under a key derived from your master password with Argon2id. Nothing is sent anywhere; there is no account and no server. • Auto-lock, lock when the screen locks, lock when idle, hidden codes, and the clipboard cleared after a copy. • A recovery code for a forgotten password, automatic local backups, and encrypted export. • Optional sync between your own Chrome browsers, encrypted, off by default. PERMISSIONS Storage for the vault; activeTab and scripting so it can read a QR code or fill a code on the page you are on, only when you ask; alarms and idle for locking; clipboardWrite and offscreen for clearing the clipboard; favicon for site icons from Chrome's own cache. No host permissions, no content scripts, no analytics, no network except an optional clock check you turn on yourself.