M2 Authenticator

Offline 2FA codes (TOTP/HOTP). AES-256-GCM encrypted vault, unlocked by master password or fingerprint.

M2 Authenticator generates two-factor authentication codes (TOTP and HOTP) directly in Chrome, so you do not have to reach for your phone every time you sign in. It is built for people who want the convenience of a browser authenticator without giving up the security properties they would get from a phone app. FULLY OPEN SOURCE Every line is public and auditable at https://github.com/hominhtuong/M2Authenticator under the MIT license. An app that holds your 2FA seeds should not ask you to take its security claims on faith, so you can read the code, verify the claims below yourself, build it from source, or fork it and run your own copy. ENCRYPTED BY DEFAULT, NOT AS AN OPTION Every 2FA secret is encrypted with AES-256-GCM before it ever touches disk. The encryption key is derived from your master password using PBKDF2-HMAC-SHA256 with 600,000 iterations and a random 16-byte salt, which matches the current OWASP recommendation. While the vault is locked, the data stored on your computer is nothing but ciphertext. Your master password is never stored anywhere, not even as a hash, so there is no password file to steal and no hash to crack offline. The extension uses a two-layer key design. A random 256-bit data key encrypts your account list, and that data key is separately wrapped by your master password and by your fingerprint. Changing your master password only rewraps 32 bytes instead of re-encrypting the whole vault, so there is never a window where your data sits half-migrated. UNLOCK WITH YOUR FINGERPRINT Use Touch ID, Windows Hello or a security key to open the vault without typing your password, through the WebAuthn PRF extension. The secret that unwraps your key never leaves the authenticator hardware in a form that can be replayed without biometric verification, and user verification is always required, so plugging in a device is not enough on its own. Your master password still works as a fallback, and removing the fingerprint never touches the password path. MOVE EVERYTHING OVER FROM GOOGLE AUTHENTICATOR IN ONE STEP A single "Transfer accounts" export QR from Google Authenticator can carry dozens of accounts. M2 decodes it, shows you every account it found, lets you tick which ones to keep and rename them inline, flags the ones you already have, and saves them in one pass. If your export is split across several QR codes, import them all at once and the extension keeps track of how many parts it has seen and how many are still missing. You can also add accounts from a normal 2FA QR image, by dragging an image onto the window, by pasting a screenshot with Ctrl+V, or by typing a Base32 secret by hand. LOCKS ITSELF AND CLEANS UP AFTER YOU - The vault auto-locks after an idle period you choose, and always locks when Chrome closes - Codes you copy are wiped from the clipboard a few seconds later, even after the popup is closed - Optional blur that hides codes until you hover, so nobody reads them over your shoulder - Repeated wrong password attempts trigger an increasing delay that survives a browser restart NO NETWORK, NO TRACKING, NO THIRD-PARTY CODE - No host permissions at all, so the extension cannot read or modify any website you visit - No content scripts, nothing is injected into the pages you browse - No network calls of any kind. The build pipeline refuses to package the extension if any source file contains fetch, XMLHttpRequest, WebSocket or importScripts - No analytics, no telemetry, no ads - Chrome sync is not used, so your vault never leaves this machine - Zero third-party libraries. Everything runs on Web Crypto, BarcodeDetector and WebAuthn, which ship with Chrome itself. There is no supply chain to compromise - No innerHTML and no eval anywhere in the codebase, with a content security policy that only allows scripts bundled with the extension - The build pipeline enforces all of the above and refuses to package a release that breaks any of them ALSO INCLUDED - TOTP and HOTP, SHA-1 / SHA-256 / SHA-512, 6 to 10 digit codes, custom periods - Live countdown ring for every code - Search and manual reordering - Verified against the official RFC 6238, RFC 4226 and RFC 4648 test vectors PLEASE READ BEFORE INSTALLING There is no backup or export feature yet. If you forget your master password, your accounts cannot be recovered by anyone, including us, because the key is derived from that password alone. Store your master password somewhere safe, and keep the recovery codes each service gives you when you enable 2FA. Note on the interface language: the user interface is currently in Vietnamese. English is planned. Requires Chrome 116 or later.