Frequently Asked Questions

You can add an account in four ways:

• Manual entry: click "Add Account" and type the account name and secret key from your service's 2FA setup page.

• QR code: click "Add Account", switch to the "QR Code" tab and upload a screenshot or photo of the code — or scan it with your camera, or straight off the screen.

• Paste a link: Settings → "Paste links". One otpauth:// link, or a whole list of them, one per line. This is how you move a hundred accounts from another app in a single action.

• A file: import a .txt of otpauth:// links, a backup from this extension, or a CXF file from another authenticator.

From the service you are protecting — Gmail, GitHub, your bank — not from this extension. The extension never sends a QR code or a key by email or text message: it reads the one the service shows you and turns it into codes.

• Sign in to the service and open its security settings
• Turn on two-factor authentication (sometimes called 2-step verification). If it offers text messages or email first, choose the authenticator app option — that is the one that shows a QR code
• The QR code appears on the screen. In the extension: Add Account → QR Code → "Scan QR from screen"
• Can't scan it? Look for a "Can't scan the QR code?" or "Enter manually" link next to it. It reveals the secret key — usually 16–32 characters, letters A–Z and digits 2–7, for example JBSWY3DPEHPK3PXP. Add it with Add Account → Manual → "Secret Key"
• Type the six-digit code from the extension back into the service. Until you do, two-factor authentication is not on

No — there is nothing to allow. The extension asks for no access to websites in advance. Chrome lets it look at a page only at the moment you use it there:

• "Scan QR from screen" captures the page in front of you when you click it. The access comes from opening the extension with its toolbar icon on that page
• "Insert 2FA code" in the right-click menu fills the field you right-clicked — the right-click itself is the permission. It is on by default; Settings → "Right-click to insert a code" turns it off and on

So Chrome's "Site access" menu for this extension has nothing to switch on, and "On all sites" is not needed.

If "Scan QR from screen" says it couldn't capture the page:

• Chrome protects some pages from every extension — its own settings pages, the Chrome Web Store, PDFs. The QR code has to be on an ordinary web page
• If you opened the extension before going to the page with the QR code, close it and open it again from the toolbar icon on that page
• Or save a screenshot of the QR code and use Add Account → QR Code → "Choose Image"

"Scan QR with camera" is different: it opens a page that asks to use your camera. If you clicked Block, allow the camera for that page in Chrome's site settings — the icon at the left of the address bar — and try again.

When you open the extension on a website, it highlights the account that matches that site and marks it "Suggested", so you do not have to look for it. It also remembers which account you used on each site.

To turn it off: Settings → "Browser" → "Suggest account for this site". Turning it off also erases what it remembered.

It reads only the address of the tab you are on, and only while the extension is open. None of it is sent to our server.

Usually the code itself is fine — it belongs to a different QR code than the one the website is waiting for. The extension checks the time on its own, so there is nothing to change on your computer.

What usually happened, and what to do:

• The website made a new QR code. It does that whenever its setup page is reloaded or opened again, and the account you added first stops matching. Start the setup on the website again, add the QR code that is on the screen now, and type its code in straight away
• The code came from another entry. If the same website is in the list twice, the newest entry is the one that works — and during setup the website wants the code of the account you just added
• Two-factor was already set up somewhere else, such as an app on your phone. The extension shows codes only for accounts added to it. To move that account here, set up the authenticator on the website again, this time with the extension
• The website wants a different code — one it sent you by text message or email, not one from an authenticator app

If the code is about to change, wait for the next one. Before you delete an old entry, export a backup first (Settings → "Export"). And if the extension itself shows a warning about the time, do what it says.

To backup your accounts:

• Click the Settings icon (gear)
• Click "Export"
• Choose how to save the file:

• Protected with a password (recommended) — the file is useless to anyone who does not know the password. Remember it: the file cannot be opened without it.
• Plain file — the whole backup as readable JSON. Only for a location you fully control.
• otpauth:// links — one link per line in a .txt file. Almost any other authenticator can read this, which makes it the format to use for moving somewhere else.
• Standard format (CXF) — the FIDO interchange format other password managers and authenticators accept.

Only the first of those is encrypted. The other three hold your secret keys in the clear, and anyone with that file can generate your 2FA codes.

To restore accounts from a backup:

• Click "import from backup" on the main screen
• Choose the file — a backup from this extension (JSON), a .txt of otpauth:// links, or a CXF file from another authenticator
• If the file is password protected, enter its password when asked
• The accounts are imported — on a new installation, as many as the free plan holds, or all of them with Pro. Nothing is imported halfway without asking you first.

If you have the links as text rather than as a file, Settings → "Paste links" takes them directly.

Note: This will add to your existing accounts, not replace them.

Yes — on every computer where Chrome is signed in to the same Google account:

• Install the extension on the other computer
• Sign in to Chrome there with the same Google account and turn sync on, with Extensions included in what Chrome syncs
• In the extension, check that Settings → "Sync across devices" is on. It is on by default
• Your accounts appear on the other computer, usually within a few minutes

If Settings says "Too many accounts to sync — they stay on this computer", Chrome's sync can't carry that many. Move them by hand instead: Settings → "Export" on one computer, "Import" on the other. A password-protected file is the safest choice.

There is no phone version: Chrome on phones doesn't run extensions. To have the codes on your phone too, scan the service's QR code with a phone authenticator app as well when you set up two-factor authentication — both will show the same codes.

If you delete an account by mistake:

• Click the Settings icon (gear) and open "Automatic copies" under "Backup & Restore". The extension takes a copy of your accounts once a day and keeps the last 7.
• Click "Restore" next to a copy from before the account was deleted. Restoring only adds the accounts that are missing — nothing you have now is changed.
• Not in any copy? Restore it from a backup file you exported: "Import" in the same section.
• Not there either? Then the way back is through the service itself: while you are still signed in there, turn 2FA off and on again and add the new QR code.

The automatic copies live inside the extension. Removing the extension or clearing the browser's data deletes them too — so don't reinstall the extension to get an account back.

TOTP codes are generated from your device clock, so if it drifts more than ~30 seconds from real time, services will reject your codes.

How to fix it:

• macOS: System Settings → General → Date & Time → turn on "Set time and date automatically"
• Windows: Settings → Time & language → Date & time → turn on "Set time automatically", then click "Sync now"
• Linux: enable NTP / automatic date & time in your settings

After syncing, reopen the extension — the warning disappears and your codes will be accepted again. Only your device clock needs fixing; the codes themselves are still generated offline.

These are advanced settings (usually defaults work):

• Algorithm: Hash function used to derive the code (SHA1 is standard)
• Digits: Code length (6 is most common, some use 8)
• Period: How long codes are valid (30 seconds standard)

Most services use: SHA1, 6 digits, 30 seconds.

Your accounts are stored in your browser — on your device, and in Chrome Sync under your own Google account if sync is on. Your secret keys, account names and codes never reach us.

• Secret keys never leave your device
• Automatic local backups (last 7) in case something goes wrong
• Stored in Chrome storage, with sync as an optional second copy

By default your codes are stored unencrypted and are protected by your computer login and Chrome profile — the same as most authenticator extensions. For stronger protection, turn on password protection in Settings: your codes are then encrypted on your device, including the backups, and cannot be read without your password.

The extension does check in with our server once a day, for the free plan and Pro — with an anonymous id and a few numbers, never your accounts. "What does the extension send to your server?" below lists everything it sends.

Once a day the extension checks in with our server, api.authenticator.sh, so that the free plan and Pro work. It sends:

• a random id created by this installation — not linked to your Google account, your email or your browser, unless you buy Pro: then your purchase links it, and any other installation where your license key is active, to the email address you paid with
• the extension version, its language and your browser's language
• when it was installed, and whether that was before version 1.14.0
• how many accounts you have — a number, never which ones
• whether password protection and sync are on, and whether it opens as a popup, a window or a side panel, and which style it uses, light or dark
• which free-plan policy and license it currently holds, and whether it already has your license key
• a short list of billing events: the limit was reached, the Pro screen was shown or closed, a plan was chosen, a checkout or a license key was tried

Our server works out your country from the request; your IP address is not stored.

It never sends your secret keys, account names, issuers, codes, or the sites you use them on. When you uninstall, the feedback page receives the same id: as it opens it tells our server that installation was removed, and an answer — if you give one — is linked to it. The privacy policy has the details, and the code that builds the request is open source.

Open Settings and turn on "Password protection". Your codes are then scrambled on this device, so nobody can read them without your password — not someone using your computer, not a virus that steals browser data, and not through your Google account sync.

You will also get a recovery code. Save it somewhere outside this browser: it is the only way back in if you forget your password. We cannot reset it for you.

You choose how often the password is asked for: every time, after a few minutes idle, or once until the browser closes. You can turn the protection off again at any time with your password.

Yes. Google Authenticator exports your accounts as a QR code on the phone, and the extension reads it with your computer's camera:

• Open Google Authenticator on your phone
• Tap the ⋮ menu (top right) → "Transfer accounts" → "Export accounts"
• Pick the accounts and tap Next. Your phone now shows a QR code
• In the extension: Add Account → QR Code → "Scan QR with camera", and point your computer's camera at the phone screen
• Exporting many accounts? Google Authenticator splits them across several QR codes — tap Next on the phone and scan each one

No camera on this computer? Photograph the QR code with another phone or camera, send the picture to your computer, and use Add Account → QR Code → "Choose Image". A screenshot won't do: on Android, Google blocks screenshots of that export screen, so a second device is the only way to capture it. "Scan QR from screen" doesn't help here either — it reads codes shown on this computer's screen, not on your phone.

No second device either? Then set the accounts up again one service at a time: on the website turn two-factor authentication off and straight back on, and use Add Account → QR Code → "Scan QR from screen".

If you already have the transfer link as text — it starts with otpauth-migration:// — paste it into Settings → "Paste links" instead.

Keep Google Authenticator on your phone until a code from the extension has been accepted.

If you lose access to this extension and have no backup:

• You'll need to disable 2FA on each affected service
• Then re-enable 2FA and add accounts again
• Keep recovery codes from services in a safe place

Prevention: Export backups regularly and store them securely!

Yes, to use. The extension is free to install, and the free plan has every feature except cloud backup:

• Installations from before version 1.14.0 keep unlimited accounts, free. Nothing changes for them.
• New installations may have a limit on how many accounts they hold for free. Pro removes the limit and adds an encrypted cloud backup.
• The limit only ever stops adding an account. Every account you already have keeps its code, and export, backups, restoring and sync keep working — with or without Pro, and after a subscription ends.

The limit is checked on your computer, from the last policy our server signed, so a limit the extension has already received applies offline too. Until the extension has reached our server once, nothing is limited.

Unlimited accounts and cloud backup. Everything else works the same with Pro and without it.

• Unlimited accounts: add as many as you need.
• Cloud backup: an encrypted copy of your accounts on our server, so losing this computer does not mean losing your codes. Turn it on in Settings → "Backup & Restore" → "Cloud backup" → "Turn on". It is locked with a backup recovery code that never leaves your browser, so we cannot open it. On a new computer, enter your license key and then that code. If Pro ends, your copies can still be restored for 90 days.
• Plans: a monthly or yearly subscription, or a one-time lifetime purchase. Which ones you see can differ while we find the right prices.
• Paying happens on Stripe Checkout, in a new tab. Link, Stripe's payment service, is the seller of record: it handles receipts, taxes and questions about an order.
• Pro turns on by itself in the browser you paid from. On another computer, open Settings → Pro → "I have a license key" and enter your key (2FA-XXXXX-XXXXX-XXXXX-XXXXX). One license works on up to 5 devices; a device that has not checked in for 60 days frees its place by itself. Need more devices? Write to support@authenticator.sh from the address you paid with, and we will raise the limit on your license.
• To manage or cancel a subscription: Settings → Pro → "Manage subscription". If you cancel, Pro stays on until the end of the period you have paid for.

The key is in the email you received after paying, and it was shown on the page that opened once the payment went through.

If you cannot find it, open the extension on the computer where you need it and go to Settings → Pro → "Get Pro" → "Restore a purchase". Enter the email address you paid with, and the key is sent there again. The same button is on the screen that appears when you reach the free limit.

If no email arrives, write to support@authenticator.sh from the address you paid with, and we will send the key to you. Never send us a secret key or a backup file — we do not need them for this.