LocalBox2FA：Browser Local 2FA Authenticator

Local-first TOTP 2FA authenticator. Google Authenticator compatible, 30s codes, QR, export/import, optional encrypted sync.

LocalBox2FA is a local-first two-factor authenticator for Chrome and Edge that keeps your TOTP codes in your own browser instead of on someone else's server. Open the popup, read the current code and paste it into the site that asks for it. Accounts stay on your device and nothing is uploaded unless you deliberately turn on encrypted sync. No account to create, no ads, no tracking. It is for anyone who wants a browser authenticator without handing their second factor to a cloud service. The vault is yours to lock. Set an optional master password and saved secrets are sealed on this device; leave it off and the extension still works, with a clear warning that secrets are stored in plain text. Closing the popup clears the unlocked key from memory. Codes, search and backups work offline. WHY LOCALBOX2FA • Standard 6-digit TOTP codes, with support for 6 to 8 digits when a service asks. • SHA-1, SHA-256 or SHA-512 and a custom refresh period for services that do not use the defaults. • A live countdown shows how long the current code is valid. • One click copies a code; the clipboard clears itself after 30 seconds. • Save, search, rename and delete accounts, with duplicate protection before a secret is saved twice. • QR codes stay hidden until you reveal them, behind a warning that the code contains the secret. • An optional master password seals saved secrets on this device. • Auto-lock after 1, 5 or 15 minutes idle; closing the popup always clears the key. ADDING AND RESTORING ACCOUNTS • Add an account from a Base32 key or an otpauth:// link. • Import a text list, an encrypted .lb2fa backup, a Google Authenticator migration QR or a screenshot of a QR code. • Choose 6, 7 or 8 digits plus the algorithm and period the service expects. • Export a readable text backup or a password-protected .lb2fa file; the backup password is independent of the master password. • If everything in a file is already saved, the import says there are no new accounts. SECURITY WITHOUT A CLOUD • Without a master password, secrets sit in plain text in the browser profile, and the settings screen says so. • With one, secrets are sealed on the device and the vault asks for the password whenever it is locked. • Auto-lock covers 1, 5 or 15 minutes of inactivity while the popup is open; closing it clears the key at once. • The master password cannot be recovered; resetting erases saved accounts, so export a backup first. • QR codes sit behind a reveal button and warn about shoulder surfing and screen recording. CROSS-DEVICE SYNC (PREMIUM) • Off by default; it needs both a master password and a Premium licence. • Records travel through your browser's own account sync — no LocalBox2FA server and no new account. • Only secrets are sealed; account names and TOTP settings stay readable to the browser sync service. • Joining an existing sync merges the accounts found in the browser account; nothing is overwritten silently. • Conflicts are shown one by one, with options to keep this device, the other device, the deletion or both. • Turning sync off keeps local accounts and leaves the synced copy in the browser account; Delete synced data removes it. FREE VS PREMIUM Free, permanently: every local feature — unlimited accounts, 6 to 8 digit TOTP, SHA-1, SHA-256 and SHA-512, custom periods, live countdown, one-click copy with 30-second clearing, search, rename, delete, duplicate protection, QR reveal, optional master password, auto-lock, text and encrypted .lb2fa export, every import format, clear-all, dark mode and six languages. Export, import and clear-all are not licence-gated. Premium (optional licence): encrypted cross-device sync only. One licence key activates on two browsers; removing it from one browser frees that slot again. Without a licence, everything else keeps working offline. HOW IT WORKS 1. Pin LocalBox2FA and open the popup. 2. Add an account from a Base32 key, an otpauth:// link, a backup file or a QR code. 3. Optional: set a master password so saved secrets are sealed on this device. 4. Copy the current code with one click; it clears from the clipboard 30 seconds later. 5. Optional: activate a licence, turn on sync and enter the same master password in your other browser. PRIVACY FIRST • No account, no analytics, no advertising and no tracking. • Secrets stay on your device and leave it only if you explicitly turn on encrypted sync, which sends sealed secrets through your browser account; the master password and licence key never leave. • The extension does not read the pages you visit; it only writes a code to the clipboard when you ask. • The only outbound request is the optional licence check for paid features. If you never activate a licence, no request is made. The check sends a random installation identifier and basic browser metadata, never secrets or codes. • Premium keeps working offline. The licence is re-checked roughly every two hours, and a failed check never locks you out. BUILT FOR DESKTOP • Desktop Google Chrome and Microsoft Edge. Sync depends on the browser account and may not be available in every Chromium browser. • The vault lives in the browser profile; removing the extension erases the accounts stored there, so keep a backup. • Works offline: codes are generated on the device. Keep your second factor close. Add LocalBox2FA, store your codes on your own device and sign in without sending your secrets to another cloud. More tools and support: https://annmax1983.com