Authenticator 1.13.0 is here. See what's new

Add to Chrome

Version 1.13.0

A hundred accounts, one paste

Paste the list your old authenticator exported and every link in it becomes an account. One action, not one per account — and the same links come back out again whenever you want to leave.

otpauth:// links, one per lineotpauth://totp/GitHub:ada@work.com?secret=JBSW…otpauth://totp/AWS:ada@work.com?secret=KRSXG5…otpauth://totp/Stripe:ada@work.com?secret=MZXW…otpauth://totp/Fastmail:ada@work.com?secret=ON…+ 94

One link, a list of them, or a Google Authenticator transfer link — the same field reads all three.

How it works

  1. 1Export from your old app. More of them can than people expect, and several write out a plain list of otpauth:// links.
  2. 2Open Settings → Paste links and paste the whole thing at once. A .txt file of the same links goes through Import instead.
  3. 3Read what it tells you. Added, already here, and — by line number — anything it could not use.

Why this is safe

A list of otpauth:// links is the most sensitive text you will ever paste anywhere: every line is a seed that generates codes for that account forever. It is worth being exact about where it goes.

It never leaves your machine

The parsing happens in the popup. There is no upload step and no server to receive one — the extension makes no network request while importing, and the only request it ever makes on its own is an optional check of your clock.

The report counts; it does not quote

When a line cannot be read you get its number and nothing else. Nothing goes to the console either: parsing used to log the name and issuer of every account it read, which was one line per scan before and would have been your entire 2FA inventory on screen after a two-hundred-account paste. It logs nothing now.

The export says what it is

A file of plain links is not encrypted, and you are told so before it is written — including when an account had to be left out of it, which you are asked about rather than informed of afterwards. The password-protected export is still there and still the one for a backup you intend to keep.

Nothing is fetched to draw your list

The optional coloured initials are drawn from the account itself — its own letter, its own stored colour. There are no favicon lookups, because fetching an icon per service would tell whoever answers precisely which sites you hold 2FA for.

None of this has to be taken on trust. The code that decides what happens to a pasted list is one readable file: read it on GitHub.

Send someone a code, not your account

A link carries up to an hour of ready-made codes and never your secret key. Whoever you send it to opens it in any browser — nothing to install, no account to make. When the hour is up, there is nothing left in the link to show.

492 713authenticator.sh/s#8Qw2rT…1 hourValid for5 min15 min30 min1 hourCreate link

The share button beside an account makes the link. Add a password and send it by another route — on its own, neither half opens anything.

Also in this release

  • Export every account as plain otpauth:// links, one per line, in a text file almost any other authenticator can read. What the export writes is exactly what the import takes back — there is a test holding the two together.
  • Coloured initials beside your accounts, off by default in Settings — and every account's full name on hover, in every view.
  • At the smallest window size the compact row gives its width back to the account name, so two accounts on the same service stop looking identical.
  • Choose where the extension opens: the popup, a floating window, or Chrome's side panel. The window and the panel stay open while you switch tabs and applications — a popup closes the moment it loses focus, which is exactly the wrong behaviour when the code has to stay in front of you while you type it.
  • When you make a share link you choose the name shown above the code — the account's own by default, or nothing at all when the person opening it has no business knowing which service it is for.
  • Add account, Edit and Share open as full screens with a back arrow instead of dialogs, and the first-run guide folds its fallback steps away so the button that ends each path stays in view.
  • Fixes: in Arabic the settings switches drew their knob outside the track, and in languages with a longer name for this app the header pushed its own icons past the edge and cut off the gear.
  • Settings ends with the version number, so answering “which version are you on?” no longer means leaving the popup to find out.

The full technical changelog is on GitHub: release notes.

Not installed yet?

Free, open source, and no account to sign up for.

Add to Chrome

Earlier releases