Keyora — 2FA Authenticator

Generate 2FA codes offline. Password-encrypted local vault, quick copying, and English/Russian interface. Developed by REcalc.

Keyora generates time-based two-factor authentication codes directly in Chrome. Add a service’s secret setup key, protect your vault with a master password, and copy a fresh code when you need to sign in. YOUR CODES, ON YOUR DEVICE • Works offline, with no Keyora account or cloud connection. • Account records and secret keys are encrypted locally with AES-256-GCM. • Passwords/PINs are never saved. An optional unlock key cache is held only in browser memory. • No analytics, advertising, background website access or remote code. EVERYDAY FEATURES • Add accounts manually using a Base32 setup key. • Watch codes refresh automatically with a countdown. • Click a code to copy a freshly calculated value. • Search, edit and delete your saved accounts. • Choose an English or Russian interface. • Switch between a master password and a 6–12 digit PIN without losing accounts. • Choose 1, 5, 15, 30 or 60 minutes before another prompt, or authenticate every opening. • Compact cards with search and add controls in one row. TOTP COMPATIBILITY Supports SHA-1, SHA-256 and SHA-512, 6 or 8 digits, and 30- or 60-second intervals. The default is SHA-1 / 6 digits / 30 seconds. Use the values specified by your service. VAULT PROTECTION Create a master password initially; Settings can re-encrypt the vault under a password or PIN after you confirm your current credential. PBKDF2-HMAC-SHA-256 uses 600,000 iterations with AES-256-GCM. A PIN is less resistant to guessing than a long password. By default closing/hiding locks the vault, with a five-minute idle lock while open. Optional fixed intervals survive popup close without extending on reopen. AES key material is held only in Chrome session memory, never written to disk by Keyora; expired entries are rejected and removed on access. Manual lock or browser restart requires authentication again. Failed attempts trigger a local backoff. PERMISSIONS Storage keeps the encrypted vault and preferences and attempt counters on this device, plus the temporary in-memory session key. Clipboard write access copies a code only after you click it. Keyora does not read your clipboard or access websites in your tabs. BEFORE YOU START Enable 2FA in the service itself and copy its manual setup key into Keyora. QR scanning, other authenticator imports and backup/restore are not included in this version. Keep your service recovery codes separately: a forgotten password or PIN cannot be recovered, and removing the extension or its local data removes access to the vault. Accurate device time is required for valid codes. Keyora processes authentication information and any account label you enter only on your device; the developer does not receive them. Language, protection preferences, public encryption parameters and attempt counters are unencrypted. Developed by REcalc — https://recalc.ru