Frequently Asked Questions

You can add an account in four ways:

• Manual entry: click "Add Account" and type the account name and secret key from your service's 2FA setup page.

• QR code: click "Add Account", switch to the "QR Code" tab and upload a screenshot or photo of the code — or scan it with your camera, or straight off the screen.

• Paste a link: Settings → "Paste links". One otpauth:// link, or a whole list of them, one per line. This is how you move a hundred accounts from another app in a single action.

• A file: import a .txt of otpauth:// links, a backup from this extension, or a CXF file from another authenticator.

When setting up 2FA on any service (Gmail, GitHub, etc.):

• Look for "Can't scan the QR code?" or "Enter manually" link
• Click it to reveal the secret key
• The key is usually 16-32 characters (letters A-Z and numbers 2-7)
• Example: JBSWY3DPEHPK3PXP

If codes are rejected, the most common reason is time synchronization:

• Your computer clock must be accurate (within 30 seconds)
• TOTP codes are time-based and expire every 30 seconds
• Check if you see a time warning at the top of the app
• Fix: Update your system time or enable automatic time sync

To backup your accounts:

• Click the Settings icon (gear)
• Click "Export"
• Choose how to save the file:

• Protected with a password (recommended) — the file is useless to anyone who does not know the password. Remember it: the file cannot be opened without it.
• Plain file — the whole backup as readable JSON. Only for a location you fully control.
• otpauth:// links — one link per line in a .txt file. Almost any other authenticator can read this, which makes it the format to use for moving somewhere else.
• Standard format (CXF) — the FIDO interchange format other password managers and authenticators accept.

Only the first of those is encrypted. The other three hold your secret keys in the clear, and anyone with that file can generate your 2FA codes.

To restore accounts from a backup:

• Click "import from backup" on the main screen
• Choose the file — a backup from this extension (JSON), a .txt of otpauth:// links, or a CXF file from another authenticator
• If the file is password protected, enter its password when asked
• The accounts are imported — on a new installation, as many as the free plan holds, or all of them with Pro. Nothing is imported halfway without asking you first.

If you have the links as text rather than as a file, Settings → "Paste links" takes them directly.

Note: This will add to your existing accounts, not replace them.

Yes — on every computer where Chrome is signed in to the same Google account:

• Install the extension on the other computer
• Sign in to Chrome there with the same Google account and turn sync on, with Extensions included in what Chrome syncs
• In the extension, check that Settings → "Sync across devices" is on. It is on by default
• Your accounts appear on the other computer, usually within a few minutes

If Settings says "Too many accounts to sync — they stay on this computer", Chrome's sync can't carry that many. Move them by hand instead: Settings → "Export" on one computer, "Import" on the other. A password-protected file is the safest choice.

There is no phone version: Chrome on phones doesn't run extensions. To have the codes on your phone too, scan the service's QR code with a phone authenticator app as well when you set up two-factor authentication — both will show the same codes.

If you delete an account by mistake:

• Click the Settings icon (gear) and open "Automatic copies" under "Backup & Restore". The extension takes a copy of your accounts once a day and keeps the last 7.
• Click "Restore" next to a copy from before the account was deleted. Restoring only adds the accounts that are missing — nothing you have now is changed.
• Not in any copy? Restore it from a backup file you exported: "Import" in the same section.
• Not there either? Then the way back is through the service itself: while you are still signed in there, turn 2FA off and on again and add the new QR code.

The automatic copies live inside the extension. Removing the extension or clearing the browser's data deletes them too — so don't reinstall the extension to get an account back.

TOTP codes are generated from your device clock, so if it drifts more than ~30 seconds from real time, services will reject your codes.

How to fix it:

• macOS: System Settings → General → Date & Time → turn on "Set time and date automatically"
• Windows: Settings → Time & language → Date & time → turn on "Set time automatically", then click "Sync now"
• Linux: enable NTP / automatic date & time in your settings

After syncing, reopen the extension — the warning disappears and your codes will be accepted again. Only your device clock needs fixing; the codes themselves are still generated offline.

These are advanced settings (usually defaults work):

• Algorithm: Hash function used to derive the code (SHA1 is standard)
• Digits: Code length (6 is most common, some use 8)
• Period: How long codes are valid (30 seconds standard)

Most services use: SHA1, 6 digits, 30 seconds.

Your accounts are stored in your browser — on your device, and in Chrome Sync under your own Google account if sync is on. Your secret keys, account names and codes never reach us.

• Secret keys never leave your device
• Automatic local backups (last 7) in case something goes wrong
• Stored in Chrome storage, with sync as an optional second copy

By default your codes are stored unencrypted and are protected by your computer login and Chrome profile — the same as most authenticator extensions. For stronger protection, turn on password protection in Settings: your codes are then encrypted on your device, including the backups, and cannot be read without your password.

The extension does check in with our server once a day, for the free plan and Pro — with an anonymous id and a few numbers, never your accounts. "What does the extension send to your server?" below lists everything it sends.

Once a day the extension checks in with our server, api.authenticator.sh, so that the free plan and Pro work. It sends:

• a random id created by this installation — not linked to your Google account, your email or your browser, unless you buy Pro: then your purchase links it, and any other installation where your license key is active, to the email address you paid with
• the extension version, its language and your browser's language
• when it was installed, and whether that was before version 1.14.0
• how many accounts you have — a number, never which ones
• whether password protection and sync are on, and whether it opens as a popup, a window or a side panel
• which free-plan policy and license it currently holds, and whether it already has your license key
• a short list of billing events: the limit was reached, the Pro screen was shown or closed, a plan was chosen, a checkout or a license key was tried

Our server works out your country from the request; your IP address is not stored.

It never sends your secret keys, account names, issuers, codes, or the sites you use them on. When you uninstall, the feedback page receives the same id: as it opens it tells our server that installation was removed, and an answer — if you give one — is linked to it. The privacy policy has the details, and the code that builds the request is open source.

Open Settings and turn on "Password protection". Your codes are then scrambled on this device, so nobody can read them without your password — not someone using your computer, not a virus that steals browser data, and not through your Google account sync.

You will also get a recovery code. Save it somewhere outside this browser: it is the only way back in if you forget your password. We cannot reset it for you.

You choose how often the password is asked for: every time, after a few minutes idle, or once until the browser closes. You can turn the protection off again at any time with your password.

Yes. Google Authenticator exports your accounts as a QR code on the phone, and the extension reads it with your computer's camera:

• Open Google Authenticator on your phone
• Tap the ⋮ menu (top right) → "Transfer accounts" → "Export accounts"
• Pick the accounts and tap Next. Your phone now shows a QR code
• In the extension: Add Account → QR Code → "Scan QR with camera", and point your computer's camera at the phone screen
• Exporting many accounts? Google Authenticator splits them across several QR codes — tap Next on the phone and scan each one

No camera on this computer? Photograph the QR code with another phone or camera, send the picture to your computer, and use Add Account → QR Code → "Choose Image". A screenshot won't do: on Android, Google blocks screenshots of that export screen, so a second device is the only way to capture it. "Scan QR from screen" doesn't help here either — it reads codes shown on this computer's screen, not on your phone.

No second device either? Then set the accounts up again one service at a time: on the website turn two-factor authentication off and straight back on, and use Add Account → QR Code → "Scan QR from screen".

If you already have the transfer link as text — it starts with otpauth-migration:// — paste it into Settings → "Paste links" instead.

Keep Google Authenticator on your phone until a code from the extension has been accepted.

If you lose access to this extension and have no backup:

• You'll need to disable 2FA on each affected service
• Then re-enable 2FA and add accounts again
• Keep recovery codes from services in a safe place

Prevention: Export backups regularly and store them securely!

Yes, to use. The extension is free to install, and the free plan has every feature:

• Installations from before version 1.14.0 keep unlimited accounts, free. Nothing changes for them.
• New installations may have a limit on how many accounts they hold for free. Pro removes the limit.
• The limit only ever stops adding an account. Every account you already have keeps its code, and export, backups, restoring and sync keep working — with or without Pro, and after a subscription ends.

The limit is checked on your computer, from the last policy our server signed, so a limit the extension has already received applies offline too. Until the extension has reached our server once, nothing is limited.

Unlimited accounts. That is the whole difference: everything else works the same with Pro and without it.

• Plans: a monthly or yearly subscription, or a one-time lifetime purchase. Which ones you see can differ while we find the right prices.
• Paying happens on Stripe Checkout, in a new tab. Link, Stripe's payment service, is the seller of record: it handles receipts, taxes and questions about an order.
• Pro turns on by itself in the browser you paid from. On another computer, open Settings → Pro → "I have a license key" and enter your key (2FA-XXXXX-XXXXX-XXXXX-XXXXX). One license works on up to 5 devices; a device that has not checked in for 60 days frees its place by itself.
• To manage or cancel a subscription: Settings → Pro → "Manage subscription". If you cancel, Pro stays on until the end of the period you have paid for.

The key is in the email you received after paying, and it was shown on the page that opened once the payment went through.

If you cannot find it, open the extension on the computer where you need it and go to Settings → Pro → "Get Pro" → "Restore a purchase". Enter the email address you paid with, and the key is sent there again. The same button is on the screen that appears when you reach the free limit.

If no email arrives, write to support@authenticator.sh from the address you paid with, and we will send the key to you. Never send us a secret key or a backup file — we do not need them for this.