Two-factor authenticator. TOTP and HOTP codes from an encrypted vault that never leaves your browser.
Users
4
store count
Rating
0.0 / 5
unchanged in 30 days
Ratings
0
total ratings
Store rank
#273K
#227K among extensions
Version
0.14.6
updated 13 Oct 2026
About AS Authenticator
Two-factor authentication (2FA) for every site that offers it: an authenticator app for time-based one-time passwords (OTP, TOTP), counter-based codes (HOTP), Steam Guard and multi-factor (MFA) login codes, generated offline in your browser. A free, open-source alternative to Google Authenticator, Authy, Microsoft Authenticator, 2FAS and Aegis, with imports from all of them. No account, no cloud, no tracking.
AS Authenticator generates two-factor codes in your browser and keeps the secrets in an encrypted vault that never leaves it.
WHAT IT DOES
• TOTP, HOTP and Steam Guard codes, with the account for the site you are on shown first.
• One click copies a code; the bolt fills it straight into the login field, including split six-box forms. Keyboard shortcuts fill and scan without opening
the popup.
• Add accounts by dragging a box around the QR code on a page, scanning the whole page, using your camera, choosing an image, pasting a link, or typing a
secret. A Google Authenticator export brings in every account at once, and Aegis, 2FAS and Bitwarden files import directly.
• Brand icons for well-known services, or an icon of your own. Categories, pins, drag to reorder, search.
HOW IT PROTECTS YOU
• The vault is encrypted with AES-256-GCM under a key derived from your master password with Argon2id. Nothing is sent anywhere; there is no account and no
server.
• Auto-lock, lock when the screen locks, lock when idle, hidden codes, and the clipboard cleared after a copy.
• A recovery code for a forgotten password, automatic local backups, and encrypted export.
• Optional sync between your own Chrome browsers, encrypted, off by default.
PERMISSIONS
Storage for the vault; activeTab and scripting so it can read a QR code or fill a code on the page you are on, only when you ask; alarms and idle for
locking; clipboardWrite and offscreen for clearing the clipboard; favicon for site icons from Chrome's own cache. No host permissions, no content scripts, no
analytics, no network except an optional clock check you turn on yourself.