claviger

Open Source 2FA Authenticator

claviger is an open-source two-factor authenticator for the browser. It keeps the TOTP, HOTP and Steam Guard secrets in an encrypted vault on your own device and shows the right one-time code when a site asks for it. EVERYDAY USE - A countdown next to each one; near the end of a period the next code appears dimmed. - "This site": what you linked to a site is shown at the top while you are on it. - Fill on request: press Alt+Shift+O or right-click a field and choose "Fill with claviger". It works only for logins linked to that site, only on https, and the secret key never reaches the page. - Add new ones by scanning a QR on the screen, from an image file, by pasting an image (Ctrl+V), or by typing the setup key. - Groups, pinning, search and drag-and-drop ordering. - Keyboard friendly: type to search, arrows to move, Enter to copy, Shift+Enter to fill. - Open it as a popup (three sizes), in the side panel or in its own window. Normal, Compact or Hidden view; light, dark or system theme; English or Turkish. SECURITY - Everything is protected with AES-256-GCM; the key is guarded by your master password (Argon2id) and an optional recovery code. - You choose when it locks: on browser close, on screen lock, after 15 minutes, 1 hour or 4 hours of inactivity, or never. A shortcut locks it at once. - Exporting and changing security settings ask for your password again. - The clipboard is cleared 1 minute after copying (30 seconds or never are also available). - Deleted entries stay in "Recently deleted" for 30 days, and daily local copies of the vault are kept (the last 7). MOVING IN AND OUT - Import from apps such as Google Authenticator, Aegis, 2FAS and Bitwarden, including their protected backups where supported, and preview everything before it is saved. Full list: https://github.com/oballi/claviger/wiki/Import-and-Export - Find duplicates and merge them, with undo. - Export a password-protected backup, a file other authenticator apps can import, or a plain otpauth:// list. Move entries to a phone with QR codes. - A reminder appears when you have not made a backup for a while. EASY SETUP - Five short steps: master password, optional recovery code, lock setting, storage, first login. The setup card stays readable on large screens and its Continue button is always in view. PRIVACY - No sign-up, no server, no analytics, no tracking. Nothing is loaded from the internet. - The vault stays in your browser's local storage. Browser sync is optional and carries only protected data. - The only network request is the optional clock check, which you start yourself: one cookie-free request to www.google.com to read the time. - Privacy policy: https://github.com/oballi/claviger/blob/main/PRIVACY.md OPEN SOURCE MIT licensed. Source, documentation and issue tracker: https://github.com/oballi/claviger