Frequently Asked Questions

You can add an account in two ways:

• Manual Entry: Click "Add Account", enter the account name and secret key from your service's 2FA setup page.

• QR Code: Click "Add Account", switch to the "QR Code" tab, and upload a screenshot or photo of the QR code shown during 2FA setup.

When setting up 2FA on any service (Gmail, GitHub, etc.):

• Look for "Can't scan the QR code?" or "Enter manually" link
• Click it to reveal the secret key
• The key is usually 16-32 characters (letters A-Z and numbers 2-7)
• Example: JBSWY3DPEHPK3PXP

If codes are rejected, the most common reason is time synchronization:

• Your computer clock must be accurate (within 30 seconds)
• TOTP codes are time-based and expire every 30 seconds
• Check if you see a time warning at the top of the app
• Fix: Update your system time or enable automatic time sync

To backup your accounts:

• Click the Settings icon (gear)
• Click "Export"
• Choose how to save the file:

• Protected with a password (recommended) — the file is useless to anyone who does not know the password. Remember it: the file cannot be opened without it.
• Plain file — readable by anyone who opens it. Only for a location you fully control.

A plain export contains your secret keys in the clear. Anyone holding that file can generate your 2FA codes.

To restore accounts from a backup:

• Click "import from backup" on the main screen
• Select your backup JSON file
• If the file is password protected, enter its password when asked
• All accounts will be imported

Note: This will add to your existing accounts, not replace them.

Yes! If you enable Chrome Sync:

• Your accounts will sync across all your Chrome browsers
• You can also manually export and import on different devices
• Note: Local storage is also used as a backup

If you accidentally delete an account:

• Check your automatic backups (stored for 7 days)
• Or restore from your manual backup file
• If no backup exists, you'll need to disable and re-enable 2FA on that service

Tip: Always export a backup before making major changes!

TOTP codes are generated from your device clock, so if it drifts more than ~30 seconds from real time, services will reject your codes.

How to fix it:

• macOS: System Settings → General → Date & Time → turn on "Set time and date automatically"
• Windows: Settings → Time & language → Date & time → turn on "Set time automatically", then click "Sync now"
• Linux: enable NTP / automatic date & time in your settings

After syncing, reopen the extension — the warning disappears and your codes will be accepted again. Only your device clock needs fixing; the codes themselves are still generated offline.

These are advanced settings (usually defaults work):

• Algorithm: Hash function used to derive the code (SHA1 is standard)
• Digits: Code length (6 is most common, some use 8)
• Period: How long codes are valid (30 seconds standard)

Most services use: SHA1, 6 digits, 30 seconds.

Your accounts live only on your device. We have no servers and never receive your data.

• Secret keys never leave your device
• Automatic local backups (last 7) in case something goes wrong
• Stored in Chrome storage, with sync as an optional second copy

By default your codes are stored unencrypted and are protected by your computer login and Chrome profile — the same as most authenticator extensions. For stronger protection, turn on password protection in Settings: your codes are then encrypted on your device, including the backups, and cannot be read without your password.

Open Settings and turn on "Password protection". Your codes are then scrambled on this device, so nobody can read them without your password — not someone using your computer, not a virus that steals browser data, and not through your Google account sync.

You will also get a recovery code. Save it somewhere outside this browser: it is the only way back in if you forget your password. We cannot reset it for you.

You choose how often the password is asked for: every time, after a few minutes idle, or once until the browser closes. You can turn the protection off again at any time with your password.

Yes! Google Authenticator has an export feature:

• Open Google Authenticator app
• Tap "Transfer accounts" → "Export accounts"
• Select accounts to export
• Take a screenshot of the QR code
• In this app: Add Account → QR Code → upload the screenshot

If you lose access to this extension and have no backup:

• You'll need to disable 2FA on each affected service
• Then re-enable 2FA and add accounts again
• Keep recovery codes from services in a safe place

Prevention: Export backups regularly and store them securely!