Two-factor authentication,the way it should be.

Your accounts are stored in your browser — on your device, and in Chrome Sync under your own Google account if sync is on. Your secret keys, account names and codes never reach us.

• Secret keys never leave your device
• Automatic local backups (last 7) in case something goes wrong
• Stored in Chrome storage, with sync as an optional second copy

By default your codes are stored unencrypted and are protected by your computer login and Chrome profile — the same as most authenticator extensions. For stronger protection, turn on password protection in Settings: your codes are then encrypted on your device, including the backups, and cannot be read without your password.

The extension does check in with our server once a day, for the free plan and Pro — with an anonymous id and a few numbers, never your accounts. "What does the extension send to your server?" below lists everything it sends.

Yes, to use. The extension is free to install, and the free plan has every feature:

• Installations from before version 1.14.0 keep unlimited accounts, free. Nothing changes for them.
• New installations may have a limit on how many accounts they hold for free. Pro removes the limit.
• The limit only ever stops adding an account. Every account you already have keeps its code, and export, backups, restoring and sync keep working — with or without Pro, and after a subscription ends.

The limit is checked on your computer, from the last policy our server signed, so a limit the extension has already received applies offline too. Until the extension has reached our server once, nothing is limited.

Yes — on every computer where Chrome is signed in to the same Google account:

• Install the extension on the other computer
• Sign in to Chrome there with the same Google account and turn sync on, with Extensions included in what Chrome syncs
• In the extension, check that Settings → "Sync across devices" is on. It is on by default
• Your accounts appear on the other computer, usually within a few minutes

If Settings says "Too many accounts to sync — they stay on this computer", Chrome's sync can't carry that many. Move them by hand instead: Settings → "Export" on one computer, "Import" on the other. A password-protected file is the safest choice.

There is no phone version: Chrome on phones doesn't run extensions. To have the codes on your phone too, scan the service's QR code with a phone authenticator app as well when you set up two-factor authentication — both will show the same codes.

Yes. Google Authenticator exports your accounts as a QR code on the phone, and the extension reads it with your computer's camera:

• Open Google Authenticator on your phone
• Tap the ⋮ menu (top right) → "Transfer accounts" → "Export accounts"
• Pick the accounts and tap Next. Your phone now shows a QR code
• In the extension: Add Account → QR Code → "Scan QR with camera", and point your computer's camera at the phone screen
• Exporting many accounts? Google Authenticator splits them across several QR codes — tap Next on the phone and scan each one

No camera on this computer? Photograph the QR code with another phone or camera, send the picture to your computer, and use Add Account → QR Code → "Choose Image". A screenshot won't do: on Android, Google blocks screenshots of that export screen, so a second device is the only way to capture it. "Scan QR from screen" doesn't help here either — it reads codes shown on this computer's screen, not on your phone.

No second device either? Then set the accounts up again one service at a time: on the website turn two-factor authentication off and straight back on, and use Add Account → QR Code → "Scan QR from screen".

If you already have the transfer link as text — it starts with otpauth-migration:// — paste it into Settings → "Paste links" instead.

Keep Google Authenticator on your phone until a code from the extension has been accepted.

Usually the code itself is fine — it belongs to a different QR code than the one the website is waiting for. The extension checks the time on its own, so there is nothing to change on your computer.

What usually happened, and what to do:

• The website made a new QR code. It does that whenever its setup page is reloaded or opened again, and the account you added first stops matching. Start the setup on the website again, add the QR code that is on the screen now, and type its code in straight away
• The code came from another entry. If the same website is in the list twice, the newest entry is the one that works — and during setup the website wants the code of the account you just added
• Two-factor was already set up somewhere else, such as an app on your phone. The extension shows codes only for accounts added to it. To move that account here, set up the authenticator on the website again, this time with the extension
• The website wants a different code — one it sent you by text message or email, not one from an authenticator app

If the code is about to change, wait for the next one. Before you delete an old entry, export a backup first (Settings → "Export"). And if the extension itself shows a warning about the time, do what it says.