Overview
Open-source, local-only authenticator for time-based one-time passwords (TOTP).
Use your computer browser for 2FA so you don't need to reach for your phone every time you log in to e.g. your Microsoft account. ReDD 2FA is developed by computer scientists at the University of Oxford (Dr Ulrik Lyngs) and the University of Maastricht (Dr Konrad Kollnig, Henry Tari), as part of the Reduce Digital Distraction project (reddfocus.org). āļø How it works Two-factor authentication (2FA) makes digital life much more secure ā a hacker can't get in with your password alone. ReDD 2FA is an authenticator that uses the most common method: time-based one-time passwords (TOTP). You add a 2FA secret key from any service that supports TOTP (e.g. a university Microsoft account). ReDD 2FA encrypts it locally and generates a fresh 6-digit login code every 30 seconds. All data is stored locally in encrypted form in the browser using the extension storage API. Nothing is sent over the network. The code is fully open-source ā you can find it at https://github.com/ulyngs/redd-2fa Secret keys are encrypted with AES-256-GCM, using a master passphrase that is key-derived via PBKDF2 with 600,000 iterations. The extension auto-locks after inactivity and clears copied codes from the clipboard after 30 seconds. šļø Biometric unlock On supported devices, you can unlock with Touch ID or Windows Hello instead of your passphrase. This uses the WebAuthn PRF extension ā the passphrase is never stored in plain text. š¦ Backup and migration Users can export password-protected backups or view their secret keys to transfer accounts to a different authenticator.
Details
- Version1.6
- UpdatedFebruary 18, 2026
- Size53.12KiB
- LanguagesEnglish (United Kingdom)
- Developer
- TraderThis developer has identified itself as a trader per the definition from the European Union and committed to only offer products or services that comply with EU laws.
Privacy
This developer declares that your data is
- Not being sold to third parties, outside of the approved use cases
- Not being used or transferred for purposes that are unrelated to the item's core functionality
- Not being used or transferred to determine creditworthiness or for lending purposes
Support
For help with questions, suggestions, or problems, visit the developer's support site
