Fill it, or right-click it in.
Click Fill in the popup, or right-click any code field and choose Insert 2FA code.
Free & open-source 2FA for Chrome
A new key every30 seconds.One click to use it.
Totpy keeps your two-factor codes in Chrome, encrypted end to end. Fill them with a click, sync them without trusting anyone, and leave your phone in your pocket.
- No account
- No servers
- No paywall
Live demo keynext key in 30s
How it works
- 01
A site asks for your code.
The six-digit dance, every single sign-in. Usually with your phone somewhere else.
- 02
Totpy already knows which one.
Open it and the account for the site you’re on is waiting at the top.
- 03
One click. You’re in.
Fill types the code straight into the page. That’s the whole workflow.
End-to-end encrypted sync
What you see. What the cloud sees.
Your vault is encrypted on your device before it leaves. Chrome sync and Google Drive keep your computers in step, and only ever hold the column on the right.
Your screenplaintext
OOrbityou@work.com--- ---
NNorthwindadmin@northwind.io--- ---
AAcme Cloudops@acme.dev--- ---
PPixel Mailme@pixel.email--- ---
Chrome sync · Google Driveciphertext
JWelxRZYlcHmyHwkLBN4C45vLzA6/9
hlzQDjvHLdMGXalfMDZuvw1O/FISyN
VF0fz0H2ITEMJ4m/FtTJaG88jo3SN3
NZCohVHc2dzdqtI8LnmGxhtxejBKqm
↑ Real ciphertext, encrypted in your browser moments ago with a throwaway key. Totpy has no servers, so this is all anyone else ever stores.
01
Chrome sync
Works the moment you install it in a signed-in Chrome profile.
02
Google Drive
Unlimited accounts in a hidden app folder, with version history.
03
Every device follows
New accounts, edits, deletions and password changes merge on their own.
Features
Small details. Big difference.
Everything an authenticator should do, plus the things you only notice once you’ve had them.
Knows the site.
The right account is suggested before you search.
Scans the screen.
No phone camera. Just the QR code on the page.
Brings your accounts.
Import a whole Google Authenticator export in one go.
Never locked out.
A recovery code resets a forgotten password.
Undo for a week.
An encrypted copy every day, kept for 7 days.
Catches clock drift.
Warns you before a site rejects a code.
$0
Free. Actually free.
No limits, no tiers, no ads, no “Pro”. MIT licensed, forever.
Security
The spec sheet.
Open source, so you don’t have to take our word for any of it. Here is exactly how your codes are protected.
- Encryption
- AES-256-GCMAuthenticated encryption for everything stored or synced.
- Password hardening
- 600,000× PBKDF2-SHA-256Every password guess costs an attacker 600,000 rounds.
- Vault key
- 256-bitRandom, and locked by both your password and your recovery code.
- Recovery code
- 160-bitShown once. Never stored in plain text.
- Sync integrity
- HMAC-SHA-256Tampered or downgraded copies are rejected, not merged.
- Website access
- activeTabOnly the tab you click Fill or Insert on. Never in the background.
0Servers
0Trackers
0Accounts to create
0Minified files
What Totpy never asks of you
- Create an account.
- Reach for your phone.
- Pay every month.
- Get tracked.
Just your codes.
FAQ
Questions, answered.
Is Totpy really free?
Yes. Every feature is free with no account limits, and the code is MIT licensed. There is no paid tier, and nothing to upgrade to.
What if I forget my master password?
Click “Forgot password?”, enter your recovery code and choose a new password. If you lose both, nobody can decrypt your codes, including us. Keep the backup codes websites give you when you turn on 2FA.
Can anyone else see my codes?
No. Totpy has no servers. Codes are generated on your device, and sync providers only store an encrypted file that only your password or recovery code can open.
Is it safe to keep 2FA codes in my browser?
Totpy encrypts your codes and locks itself, but it shares a device with your passwords. For your most important accounts, a hardware security key is stronger still. Our security design explains the trade-offs openly.
How do I move from Google Authenticator?
In Google Authenticator choose Transfer accounts → Export accounts, take a photo of the QR code, then click + → Upload QR in Totpy. All accounts come across at once.
Which browsers are supported?
Totpy is built and tested for Google Chrome. Other Chromium browsers should work, but Google Drive sync needs Chrome. Firefox is on the roadmap.
Does it work offline?
Yes. Codes are computed on your device. Only sync and the occasional clock check need a connection.
Is the demo key on this page safe to scan?
Yes. It’s a public demo secret that protects nothing. It exists so you can check that Totpy’s codes match your own authenticator.
This code expires in 30s.
Totpy doesn’t.
Free, open source and yours to keep. Install it in under a minute.
Chrome Web Store listing coming soon