Frequently Asked Questions

You can add an account in four ways:

• Manual entry: click "Add Account" and type the account name and secret key from your service's 2FA setup page.

• QR code: click "Add Account", switch to the "QR Code" tab and upload a screenshot or photo of the code — or scan it with your camera, or straight off the screen.

• Paste a link: Settings → "Paste links". One otpauth:// link, or a whole list of them, one per line. This is how you move a hundred accounts from another app in a single action.

• A file: import a .txt of otpauth:// links, a backup from this extension, or a CXF file from another authenticator.

When setting up 2FA on any service (Gmail, GitHub, etc.):

• Look for "Can't scan the QR code?" or "Enter manually" link
• Click it to reveal the secret key
• The key is usually 16-32 characters (letters A-Z and numbers 2-7)
• Example: JBSWY3DPEHPK3PXP

If codes are rejected, the most common reason is time synchronization:

• Your computer clock must be accurate (within 30 seconds)
• TOTP codes are time-based and expire every 30 seconds
• Check if you see a time warning at the top of the app
• Fix: Update your system time or enable automatic time sync

To backup your accounts:

• Click the Settings icon (gear)
• Click "Export"
• Choose how to save the file:

• Protected with a password (recommended) — the file is useless to anyone who does not know the password. Remember it: the file cannot be opened without it.
• Plain file — the whole backup as readable JSON. Only for a location you fully control.
• otpauth:// links — one link per line in a .txt file. Almost any other authenticator can read this, which makes it the format to use for moving somewhere else.
• Standard format (CXF) — the FIDO interchange format other password managers and authenticators accept.

Only the first of those is encrypted. The other three hold your secret keys in the clear, and anyone with that file can generate your 2FA codes.

To restore accounts from a backup:

• Click "import from backup" on the main screen
• Choose the file — a backup from this extension (JSON), a .txt of otpauth:// links, or a CXF file from another authenticator
• If the file is password protected, enter its password when asked
• All accounts will be imported

If you have the links as text rather than as a file, Settings → "Paste links" takes them directly.

Note: This will add to your existing accounts, not replace them.

Yes! If you enable Chrome Sync:

• Your accounts will sync across all your Chrome browsers
• You can also manually export and import on different devices
• Note: Local storage is also used as a backup

If you accidentally delete an account:

• Check your automatic backups (stored for 7 days)
• Or restore from your manual backup file
• If no backup exists, you'll need to disable and re-enable 2FA on that service

Tip: Always export a backup before making major changes!

TOTP codes are generated from your device clock, so if it drifts more than ~30 seconds from real time, services will reject your codes.

How to fix it:

• macOS: System Settings → General → Date & Time → turn on "Set time and date automatically"
• Windows: Settings → Time & language → Date & time → turn on "Set time automatically", then click "Sync now"
• Linux: enable NTP / automatic date & time in your settings

After syncing, reopen the extension — the warning disappears and your codes will be accepted again. Only your device clock needs fixing; the codes themselves are still generated offline.

These are advanced settings (usually defaults work):

• Algorithm: Hash function used to derive the code (SHA1 is standard)
• Digits: Code length (6 is most common, some use 8)
• Period: How long codes are valid (30 seconds standard)

Most services use: SHA1, 6 digits, 30 seconds.

Your accounts live only on your device. We have no servers and never receive your data.

• Secret keys never leave your device
• Automatic local backups (last 7) in case something goes wrong
• Stored in Chrome storage, with sync as an optional second copy

By default your codes are stored unencrypted and are protected by your computer login and Chrome profile — the same as most authenticator extensions. For stronger protection, turn on password protection in Settings: your codes are then encrypted on your device, including the backups, and cannot be read without your password.

Open Settings and turn on "Password protection". Your codes are then scrambled on this device, so nobody can read them without your password — not someone using your computer, not a virus that steals browser data, and not through your Google account sync.

You will also get a recovery code. Save it somewhere outside this browser: it is the only way back in if you forget your password. We cannot reset it for you.

You choose how often the password is asked for: every time, after a few minutes idle, or once until the browser closes. You can turn the protection off again at any time with your password.

Yes! Google Authenticator has an export feature:

• Open Google Authenticator app
• Tap "Transfer accounts" → "Export accounts"
• Select accounts to export
• Take a screenshot of the QR code
• In this app: Add Account → QR Code → upload the screenshot

If you already have the transfer link as text — it starts with otpauth-migration:// — skip the screenshot and paste it into Settings → "Paste links" instead.

If you lose access to this extension and have no backup:

• You'll need to disable 2FA on each affected service
• Then re-enable 2FA and add accounts again
• Keep recovery codes from services in a safe place

Prevention: Export backups regularly and store them securely!