Version 1.12.0

Your code, without opening anything

Right-click the code field on any site and pick one item. The code goes in. No popup, no switching windows, no reading six digits off a screen and typing them before they expire.

The menu item appears on text fields. Nothing else changes.

How it works

1Right-click the field where the code goes.
2Pick “Insert 2FA code”. The account for the site you are on is chosen for you.
3The digits land in the field — including the one-box-per-digit kind, which is handled as a paste so the boxes fill in order.

Why this is safe

Inserting a code into a page is the one thing this extension does that touches a page at all. It is worth being precise about what that means, because “it can type into websites” and “it can read websites” are very different powers, and only the first one is being asked for.

Nothing runs until you pick it

This is not a content script. No code from the extension exists on any page you visit. It is injected only when you choose the menu item, and what that gesture grants is a single tab, a single invocation, revoked as soon as you navigate. Nothing is left behind afterwards.

It has no permission to read sites

The extension declares no host permissions at all — you can check the list in the Chrome Web Store, it is four short entries and none of them is a website. It cannot read the pages you have open, and it does not know which sites you visit.

It writes; it does not collect

It looks at the input fields on the page for one purpose: to decide which one should receive the code. What it finds is used there and then and goes nowhere else. The extension makes no network request while doing this — there is no server to send anything to.

It refuses rather than guesses

If there is no field it can be confident about, it copies the code to your clipboard and says so, instead of putting it somewhere wrong. If a field is too short to hold the whole code, it declines — a truncated code looks like success and fails at the worst moment.

None of this has to be taken on trust. The entire page-side implementation is one readable file, and it is the only code that ever runs in a page: read it on GitHub.

Also in this release

Unlock a password-protected vault with a passkey — Touch ID, Windows Hello or your phone — while your password and recovery code keep working exactly as before.
Export in Credential Exchange Format, the FIDO Alliance interchange format other password managers and authenticators can read.
The clock check, which had quietly stopped working for everyone, is fixed: three independent time sources instead of two, and corrections now expire.
The interface opens in your browser's language instead of English, in all twenty languages it already shipped in.

The full technical changelog is on GitHub: release notes.

Not installed yet?

Free, open source, and no account to sign up for.

Add to Chrome