Self-hosted TOTP/HOTP extension. Scan QR codes on the page, encrypt secrets with a master password, generate codes on demand — offline.
No cloud · No sync · No telemetry
Everything runs locally. Nothing is sent anywhere.
Secrets are encrypted with AES-256-GCM before touching disk. Key derived from your master password via PBKDF2 (250k iterations). Forgetting the password means the vault is gone — by design.
Click + Add new and the extension screenshots the visible tab to find a QR code — or drag a region around it. Decoding runs offline with a bundled library.
Type in a base32 secret when a site won't give you a QR code. Full control over digits, algorithm, and TOTP/HOTP type.
Handles bulk export format (otpauth-migration://)
as well as standard otpauth:// URIs — with a
zero-dependency protobuf parser.
Codes generated on demand via WebCrypto HMAC. Countdown timer per account, manual counter generation for HOTP.
No analytics, no crash reports, no accounts, no servers. The extension never makes a network request.
Three steps from install to codes.
It derives the encryption key for your vault. Cached for the browser session only — lock anytime with one click.
Scan a QR on the page, drag-select the region, or enter the secret manually.
Open the popup to see live TOTP codes with countdown timers, or generate HOTP codes on demand.
What's on disk, and what isn't.
A random salt, an encrypted verifier, and the encrypted
account vault. No plaintext secrets ever written to
chrome.storage.local.
The derived key lives in memory-backed session storage and clears when the browser closes. Not synced, not persisted.
No password reset, no recovery, no master key escrow. Your master password is the only way in — keep it safe.
Load it unpacked in a minute.