Twofold Vault

2-step verification codes on every site: unlock once, scan QR codes on the page, fill in one click. No browsing history kept.

Twofold Vault puts your 2-step verification codes one click away on every site. Your accounts are encrypted on your device, and you unlock them once per browser session. THE RIGHT CODE FOR THE SITE YOU'RE ON • Accounts for the current site come first, marked "This site", with a one-click Fill button. Everything else is a search away. • Fill types the code into the page's code box, including forms with one box per digit. • Or press Alt+Shift+F. It fills on its own only when one account clearly matches the site; otherwise it opens the popup so you can choose. • Codes are filled only on secure (https) pages and only into the page's own frames, never into embedded frames from other sites. • Click any code to copy it. It's cleared from the clipboard after 30 seconds (you can change this). ADD ACCOUNTS WITHOUT YOUR PHONE • Scan this page: finds 2-step setup QR codes on the tab you're on. • Select an area: drag a box around a small or partly hidden QR code. • Or scan a screenshot or photo, paste an otpauth:// link, or type the setup key. • Supports time-based (TOTP) and counter-based (HOTP) codes, SHA-1, SHA-256 and SHA-512, and 6 to 8 digits. SWITCH FROM ANOTHER AUTHENTICATOR Pick the app you're leaving and follow its step-by-step export guide, then scan its export QR codes or open its export file. Multi-part QR exports and lists of otpauth:// links work too. Accounts that can't be imported are listed with the reason, never silently dropped. ENCRYPTED, UNLOCKED ONCE PER SESSION • Your vault is sealed with AES-256-GCM under a key derived from your master password with Argon2id. Only the encrypted vault is saved in Chrome. • After you unlock, the key is held in memory only. It's wiped when you lock, after inactivity (1 minute to 4 hours), when your computer locks, or when Chrome closes. • No browsing history: the current site is matched to your accounts on your device while you use the popup, and is never stored or sent. • Twofold touches a page only when you press Fill or Scan, and only that tab. • No analytics, no ads, no tracking. WORKS WITH THE TWOFOLD VAULT APPS (OPTIONAL) • Sign in to Twofold Cloud to keep this browser in sync with the Twofold Vault apps for Windows and Android. Sync is end-to-end encrypted: the server stores only the encrypted vault and never sees your services, account names, secret keys or master password. • No account? Pair with the desktop app using a one-time link, open an encrypted vault file, or start a new vault right here. Codes are generated on your device and work offline. Light and dark themes. Open the popup with Alt+Shift+V. Privacy policy: https://twofoldvault.com/privacy/