Totpy — 2FA Authenticator

Open-source 2FA codes in your browser. End-to-end encrypted sync, autofill and no account needed.

Your 2FA codes, right in Chrome. Totpy is a free, open-source authenticator that keeps your two-factor codes in the browser, where you actually sign in. No phone to reach for, no account to create, and nothing to pay for. FILL CODES IN ONE CLICK • Totpy suggests the right account for the site you're on. Click Fill and the code goes straight into the page. • Or right-click any code field and choose Insert 2FA code. • Click any code to copy it. Search, and a countdown for every code. END-TO-END ENCRYPTED SYNC • Sync between your computers through Chrome sync (no setup) or your own Google Drive. • Your vault is encrypted with your master password before it leaves the device. Google only ever stores ciphertext. • Changes merge across devices, including deletions and password changes. NEVER LOCKED OUT • A recovery code resets your master password if you forget it. • Automatic copies: one encrypted snapshot a day for the last 7 days. • Encrypted backup files, and plain otpauth:// export to move to another app at any time. SWITCH IN SECONDS • Scan a QR code shown on the page, or upload a QR image. • Import every account from Google Authenticator at once (Transfer accounts → Export). • Paste otpauth:// links, or type the setup key. BUILT FOR SECURITY • AES-256-GCM encryption. Your password is hardened with 600,000 rounds of PBKDF2-SHA-256. • Auto-lock, and locks when Chrome closes. • Warns you when your computer's clock is off far enough for codes to be rejected. • Only touches the tab you click Fill or Insert on. Never runs on pages in the background. • No servers, no analytics, no tracking. • Supports 6, 7 and 8-digit TOTP codes with SHA-1, SHA-256 or SHA-512. OPEN SOURCE Totpy is MIT licensed. The shipped code is bundled but not minified, so anyone can read what runs. Source code: https://github.com/amit-y11/totpy Security design: https://github.com/amit-y11/totpy/blob/main/docs/security.md Your master password is never stored. If you lose both your password and your recovery code, nobody can decrypt your codes. Keep the backup codes websites give you when you turn on 2FA.