Generate RFC 6238/4226 TOTP & HOTP one-time codes from an AES-256-GCM encrypted vault. Derived via PBKDF2 with 600,000 iterations. Zero telemetry, zero cloud lock-in, and store-submission ready.
Authenticator
No cloud servers. No proprietary black boxes. Every secret is protected using open, audited WebCrypto standards directly on your hardware.
Derives non-extractable 256-bit encryption keys using 600,000 rounds of PBKDF2-SHA-256 (NIST SP 800-132 recommendation) and a unique 128-bit random salt.
Authenticated encryption with 128-bit authentication tags and fresh 12-byte random initialization vectors (IV) for every account. Tampered ciphertexts are immediately rejected.
No analytics, no telemetry, no remote scripts. chrome.storage.local isolates your encrypted vault from webpage scripts and never syncs unencrypted secrets.
Toggle below to inspect the raw AES-256-GCM ciphertext persisted on disk compared to the transient in-memory decrypted accounts.
{
"meta": {
"kdfAlgorithm": "PBKDF2",
"kdfIterations": 600000, // NIST SP 800-132 recommendation
"kdfSalt": "p9X4kK7L0jQvE+TzM2w8qA==", // 128-bit random salt
"vaultVersion": 1,
"autoLockMinutes": 5
},
// AES-256-GCM authenticated ciphertext. Unreadable without master password.
"accountsCiphertext": "zY8mKl91uQp0W4rT7vX...9+aE/3xLkPn==",
"accountsIv": "3K9vL1w8rT2q", // 12-byte fresh IV
"verifierCiphertext": "A8f9L1k0X9+m=",
"verifierIv": "P0k8L2m1r5s="
}Every workflow is refined to ensure speed, accuracy, and absolute security on any device.
Scan 2FA QR codes directly from the active browser tab via activeTab screenshot capture. No webcams or smartphone cameras required.
Detects autocomplete="one-time-code" and OTP input fields. Displays an unobtrusive "Fill OTP" button that populates codes only when clicked — never auto-submitting.
One-click OTP copying with automatic clipboard sanitization after 30 seconds (configurable 10–120s) to prevent shoulder surfing or memory sniffing.
Export and import vaults with separate passphrase-encrypted JSON files. Migrate seamlessly to other devices without exposing unencrypted secrets.
Compare our zero-knowledge browser architecture against mainstream cloud-based alternatives.
| Feature / Security Parameter | Authenticator (This Ext) | Authy | Google Authenticator | Bitwarden (Premium) |
|---|---|---|---|---|
| Client-Side AES-256-GCM Vault | ✓ Yes (Standard) | ✗ Proprietary | ✗ Device-Bound | ✓ Yes |
| Zero Telemetry & Offline-Only | ✓ 100% Offline | ✗ Cloud Dependent | ✗ Google Sync | ✗ Cloud Dependent |
| PBKDF2 Iterations | ✓ 600,000 Rounds | Unknown | N/A (OS Keychain) | 600,000 Rounds |
| Tab Screenshot QR Scanner | ✓ Yes (Built-in) | ✗ Mobile Only | ✗ Mobile Only | ✗ Manual / Mobile |
| Consent-First Inline Autofill | ✓ Yes (Non-autosubmit) | ✗ No | ✗ No | ✓ Yes |
| RFC 4226 HOTP + SHA256/512 Support | ✓ Full RFC Compliance | Limited | SHA-1 Only | ✓ Full |
| Independent Encrypted Export | ✓ Yes (AES-256-GCM) | ✗ Vendor Lock-in | ✗ QR Transfer Only | ✓ Yes |
Peer-level 15–20 minute technical treatises covering zero-knowledge architecture, RFC byte specifications, and AitM phishing defense.
An exhaustive comparison of authentication factors, HMAC dynamic truncation, and defense against real-time AitM reverse proxies.
Read 18 Min Guide → Zero-Knowledge Design · 17 minHow to engineer client-side vaults using non-extractable WebCrypto keys, 600,000-round PBKDF2 stretching, and LevelDB storage isolation.
Read 17 Min Guide → Cryptography · 20 minBenchmark analysis of GPU password cracking, memory hardness tradeoffs in JS runtimes, and NIST SP 800-132 recommendations.
Read 20 Min Guide →Honest, transparent answers about threat models, recovery, and permissions.
Due to our strict zero-knowledge architecture, your master password is never stored or transmitted anywhere. If you forget your password, your vault cannot be recovered by anyone. We strongly recommend exporting an encrypted backup file immediately after setting up your accounts.
activeTab is used solely when you explicitly click "Scan QR from Current Tab" or use the "Fill OTP" button on a focused tab. Unlike broad <all_urls> host permissions, activeTab is temporary and only accessible during active user interaction.
The non-extractable CryptoKey is kept only in the background service worker's memory during active sessions. When your browser is closed, or when the configured idle timer (default 5 minutes) triggers via chrome.idle, the memory reference is wiped and the vault locks immediately.
No. Secrets are encrypted using AES-256-GCM before writing to chrome.storage.local, which is isolated to this extension's origin. Normal web page JavaScript cannot read extension storage.