FactorTwo — Authenticator & Autofill

Auto-fills your 2FA codes. Encrypted OneDrive/sync/local backup, passkey unlock, recovery code, and CXF import. No Google sign-in.

FactorTwo fills in your two-factor codes the moment a site asks — no phone, no copying, no account to create. It’s an authenticator that lives in your browser and does the typing for you. HOW IT WORKS Add an account by scanning its QR code right on the setup page, selecting a QR area, using your camera, typing the setup key, pasting an otpauth:// link, or importing a Google Authenticator export. Sign in as usual. FactorTwo recognizes the verification code field on the page, including split six-box styles. The code appears. If exactly one account is linked to that site, it’s filled in automatically. If there are several, a small key button in the field lets you pick — or use the keyboard shortcut (Ctrl+Shift+Y / Cmd+Shift+Y) or right-click and choose “Fill 2FA code.” NO GOOGLE SIGN-IN REQUIRED FactorTwo never asks you to connect a Google account. The authenticator, autofill, password lock, local backups, and encrypted file export all work with zero accounts at all. EVERY CODE TYPE TOTP, HOTP, and Steam Guard codes, with SHA-1, SHA-256, or SHA-512, 6–8 digits, and any time period. BACKUPS YOU CONTROL Back up your encrypted vault to OneDrive, Dropbox, your browser’s own sync, a rolling set of local snapshots, or an encrypted file you export yourself. Everything is encrypted in your browser (AES-256-GCM, with a key derived from your own phrase via PBKDF2-SHA256 at 600,000 iterations) before it goes anywhere — storage providers only ever see ciphertext. ONE VAULT, THREE WAYS BACK IN Set a password and your accounts are encrypted on disk, with auto-lock after a timeout or whenever your computer locks. Add a recovery code and a passkey (Windows Hello, Touch ID, or your phone) and you’re never locked out — all three unlock the same vault independently, so changing your password never breaks your recovery code or passkey. SHARE A LIVE CODE Need to hand a running code to someone for a moment — a shared account, a family member, a teammate? Generate a time-limited link that shows the live, refreshing code in their browser until it expires. SIDE PANEL Pin FactorTwo to Chrome’s side panel so your codes stay visible and in sync with whatever tab you’re on, instead of reopening the popup every time. EMAILED CODES & SIGN-IN LINKS (BETA) When a site says it emailed you a code or a magic link, FactorTwo reads the Gmail tab you already have open — no Gmail API, no Google sign-in, everything parsed locally. Codes fill automatically only when the sender’s domain matches the site you’re on. MOVE IN EASILY Import a Google Authenticator export, or bring accounts in and out with CXF (Credential Exchange Format) import and export, the emerging cross-app standard for password managers. CLOCK ACCURACY CHECK Time-based codes depend on your system clock. A one-click check (only when you ask — never automatic) tells you if it’s drifted enough to break your codes. AVAILABLE IN 5 LANGUAGES English, Spanish, French, German, and Japanese. BUILT TO BE TRUSTWORTHY No analytics, no telemetry, no ads, no servers of ours. Page scripts never see your secrets — only the current code for an account that matches that page, filled through a closed shadow root that only responds to real clicks. Accounts match a site by its registered domain; lookalike domains never match. Requires Chrome 116 or newer.