OTPilot – Password Manager, 2FA Authenticator & AI Agents

Password manager with built-in 2FA, SSH keys, crypto wallets and safe sign-in for AI agents. Fills logins and 2FA codes anywhere.

🔐 OTPilot — Password manager with built-in 2FA Fills your password and your 2FA code on any login page. End-to-end encrypted, synced across devices, free to start. And new in 2.1: let your AI agents sign in, without ever seeing your passwords. 🤖 NEW in 2.1 - AI agents that sign in safely Claude Code, Codex, Cursor or any MCP agent can sign in to websites, pass the 2FA step and run commands with the accounts you allow. OTPilot uses your passwords and 2FA codes for them, and the agent only gets the result. ✅ You approve each agent, and each account it may use, right in the extension ✅ Allow just the 2FA code, the full sign-in, or chosen fields — for an hour, a day, or until you revoke it ✅ "Ask me every time" for sensitive accounts ✅ Signs in only on the account's own website, and every secret is removed from what the agent sees ✅ Keys and files too: an agent can push with your SSH key or upload a build with your .p8 — it gets a temporary copy that's deleted when the command ends ✅ A crypto wallet's recovery phrase and private keys are never available to an agent — only its addresses ✅ An activity log of everything each agent did, and one-click revoke Connect an agent with: npx -y @otpilot/mcp connect 🔑 Passwords, filled where you sign in OTPilot shows your saved logins right inside the sign-in field. Pick one and it fills your username and password — nothing is filled without your click. ✅ Saves new logins as you sign in ✅ Updates the password when you change it ✅ Works when the username and the password are on separate pages ✅ Suggests a strong password in every new-password field 🚀 Zero-click 2FA When a verification code field appears, OTPilot automatically: • Detects the code field • Fills the current code instantly • Submits the form No phone switching. No copy/paste. No interruptions. ⚡ One-click 2FA setup When you enable 2FA on a website, OTPilot detects the setup page and asks: "Save [Service] to OTPilot?" Click Add account and you're done — and if you already have a login for that site, the code is added to it. ✅ No QR scanner apps ✅ No copying secret keys ✅ No manual setup 📧 Email verification codes, auto-filled Waiting for a one-time code by email? When a login page asks for an emailed code, OTPilot reads it from your open webmail tab and fills it in the moment it arrives. Your email is processed entirely on your device and is never sent anywhere. You can turn this off anytime in Settings. 🗂️ More than passwords Keep secure notes, servers, API keys, SSH keys, files and crypto wallets next to your logins. Add your own fields, grouped in sections, and link related items to an account — open it and everything about it is there. Filter by tag, type, or accounts with a 2FA code. 🗝️ SSH keys & secure files Keep the keys and files developers always lose track of in your encrypted vault. ✅ Generate a new SSH key (Ed25519 or RSA 4096) or import yours, with its public key and fingerprint ready to copy ✅ One click to add the public key to GitHub, GitLab or Bitbucket ✅ Store Apple .p8 keys, .p12 certificates, Google service-account JSON, .env files and provisioning profiles ✅ Drop a file on OTPilot: it recognizes what it is and fills in the details (the Key ID from an AuthKey .p8, each variable of an .env as a hidden field) ✅ Attach a file to any item, like the .p8 and .p12 on your Apple Developer login ✅ End-to-end encrypted, synced and shareable like everything else (up to 64 KB per item) 🪙 Crypto wallets Keep your wallets' recovery phrases, keys and addresses in your encrypted vault, with extra protection for what controls your funds. ✅ Recovery phrase checked as you type against the BIP39 word list and checksum, so a typo or a swapped word is caught before you rely on it ✅ Shown as a numbered word grid, easy to verify against your paper backup ✅ Passphrase, unlock password and private keys alongside it ✅ Addresses for every network, with the network detected (Bitcoin, Ethereum and EVM chains, Solana, Tron and more) and a QR code to receive funds ✅ Seeing or copying a recovery phrase or private key asks for your master password again, and a copied phrase is cleared from the clipboard after 30 seconds ✅ Sharing a wallet's secrets asks you to confirm first 🎣 Recovery phrase phishing warning No real website, support agent or airdrop ever asks for your recovery phrase, yet that's how most wallets get drained. If you type or paste one into a website, in a single field or in a grid of word boxes, OTPilot stops the form and warns you before it's sent. One click clears it. Checked entirely on your device: nothing is sent anywhere. 🔓 Inline unlock If your vault is locked, OTPilot shows an unlock prompt directly on the page. Type your master password and press Enter — OTPilot unlocks and fills immediately, without opening the popup. 👥 Multiple accounts on the same site Work + personal, several admins, staging and production: OTPilot finds every matching account and lets you pick the right one in one click. ☁️ End-to-end encrypted sync Sync your vault across browsers and devices. 🔒 Encrypted on your device before upload 🔒 The server never sees your passwords or secrets 🔒 A recovery key restores your vault if you forget your master password 👨‍👩‍👧 Share with your team Share a whole item, or just the fields you choose, with teammates and collections — end-to-end encrypted. OTPilot shows exactly what each person will get before you share. Or share live 2FA codes only: your teammate gets the code, never the secret. 🖥️ Device management Manage every connected browser from the OTPilot dashboard. • View connected devices and sync history • Remotely disconnect devices • Wipe vault access on next sync • Get email alerts for new device connections 📲 Import from anywhere • Google Authenticator: screenshot its "Transfer accounts" QR codes and select them — decoded entirely on your device • Your browser or another password manager: import its CSV export 💾 Smart backup & restore Export an encrypted backup (or a CSV) of the accounts you choose. When restoring, OTPilot detects what's already in your vault, so newer entries are never overwritten. 🛡️ Privacy first • AES-256-GCM encryption for every item • Master password protected with PBKDF2 (600,000 iterations) • Locks itself after the time you choose • Email codes are read only on your device — never transmitted • AI agents never receive a password or a code: each account you allow is encrypted to the agent's own key • SSH keys and files are encrypted like every other item; a downloaded copy is the only one outside your vault • Recovery phrases are checked on your device, and the phishing warning never sends what you type anywhere • No telemetry or analytics • Open source 💳 Plans • Free: unlimited 2FA codes, up to 50 passwords, notes and other items, and 1 AI agent with up to 3 accounts • Personal: $3/month or $30/year — unlimited items, sync and AI agents • Team: $8/month or $80/year per workspace, 5 seats included Try Personal free for 30 days. Create an account and sync is on right away: your passwords and 2FA codes on every device, end-to-end encrypted. No card needed. After 30 days you keep everything on this device and choose whether to subscribe. 🌍 Works everywhere OTPilot supports any standard TOTP-based two-factor authentication (RFC 6238): if a site lets you use an authenticator app, it works with OTPilot.