Your 2FA codes, filled in for you.
FactorTwo is a Chrome extension that keeps your authenticator codes in the browser and types them into the page the moment a site asks. No phone. No copying. No account to create.
- Fills codes automatically
- Encrypted backups
- Passkey & recovery code
- Import from Google Authenticator
FactorTwoUnlockedSet it up once. Never fetch a code again.
Three steps, and the last one happens by itself.
Add an account
Scan the QR code right on the page you're setting up, or pick a QR area, use your camera, type the setup key, paste an otpauth:// link, or import from Google Authenticator.
Sign in as usual
Enter your password on the site. When it asks for a verification code, FactorTwo recognises the field, including the split six-box kind.
The code appears
If one account is linked to the site, the current code is filled in for you. If there are several, a key button in the field lets you pick.
An authenticator that does the typing.
Everything an authenticator app does, living where you actually sign in.
It spots the code field. You don't type a thing.
FactorTwo watches for one-time-code fields, single boxes and split six-box widgets alike, and fills the right code as soon as the page asks.
- Fills automatically when exactly one account is linked to the site
- Otherwise a small key button in the field lists the matching accounts
- Prefer the keyboard? Press Ctrl+Shift+Y (⌘+Shift+Y on Mac) or right-click and choose “Fill 2FA code”
- Accounts link to a site when you scan its QR code there, or fill a code there once
Two-step verification
Enter the 6-digit code from your authenticator
Emailed code? It finds it for you.
When a site says it emailed you a code or a sign-in link, FactorTwo reads the Gmail tab you already have open. It works from the page on your screen: no Gmail API, no Google sign-in, and everything is parsed locally.
- Codes fill automatically only when the sender's domain matches the site you're on, so a phishing page can't collect a code meant for another service
- Codes from other senders show up as a one-click suggestion
- Sign-in links ask before they open, and you can allow auto-open for matching senders
One vault. Three ways back in.
Set a password and your accounts are encrypted on disk, with auto-lock after a timeout or whenever your computer locks. Add a recovery code and a passkey and you're never locked out.
- Unlock with a password, a recovery code, or a passkey (Windows Hello, Touch ID or your phone)
- Each one opens the same master key, wrapped separately, so changing your password never breaks your recovery code or passkey
- Back up to OneDrive, your browser's sync, or an encrypted file, plus the last 7 local snapshots
Unlock FactorTwo
Choose how you want to get in.
Every code type
TOTP, HOTP and Steam codes, with SHA-1, SHA-256 or SHA-512, 6 to 8 digits and any period.
Add it your way
Scan a QR code on the page, select a QR area, use your camera, type the setup key, or paste an otpauth link.
Move in easily
Import a Google Authenticator export, or bring accounts across with CXF import and export.
Backups you control
OneDrive, your browser's sync, a rolling set of local snapshots, or an encrypted file. All encrypted before they're stored.
Lock it down
An optional password encrypts accounts on disk and auto-locks after a timeout or when your computer locks.
Fast keys
One shortcut, or a right-click, fills the matching code into whatever field you're focused on.
Less fetching. Less typing. Fewer mistakes.
Compare one login with and without it.
With a phone authenticator
Every sign-in, every time.
- Sign in with your password
- Find your phone and unlock it
- Open the app and find the account
- Read the six digits
- Type them before they expire
With FactorTwo
The same login, from your keyboard.
- Sign in with your password
- FactorTwo recognises the code field
- The code is filled in
Built so a stolen backup is just noise.
Your secrets stay in your browser. Here's exactly how they're protected.
Encrypted before it goes anywhere
Backups are encrypted in your browser with AES-256-GCM, using a key derived from your phrase with PBKDF2-SHA256 at 600,000 iterations. Storage providers only ever receive ciphertext.
Codes only go where they belong
Accounts match a site by its registered domain, and lookalike domains never match. Autofill only fires when exactly one account is linked to the site.
Pages never see your secrets
Page scripts only ever receive the current code for an account that matches that page, or the one you pick. The in-page button lives in a closed shadow root and only responds to real clicks.
No tracking, no servers of ours
No analytics, no telemetry, no ads. The only network connection FactorTwo can make is to Microsoft OneDrive, and only if you choose to connect it.
Questions, answered.
Do I need a Google or Microsoft account?
No Google sign-in is needed, ever. A Microsoft account is only needed if you choose OneDrive backup. The authenticator, autofill, password lock, local backups and file export all work with no account at all.
Where are my accounts stored?
In your browser profile, on your device. If you turn on backups, encrypted copies can also go to OneDrive, your browser's sync storage, or a file you export.
Can I bring my codes over from Google Authenticator?
Yes. Export your accounts from Google Authenticator and import the migration QR code or link. You can also import otpauth:// links, an encrypted FactorTwo export, or CXF files.
What if I forget my password?
Unlock with your recovery code or your passkey instead. Both open the same vault. We can't reset anything for you because we never have your keys, so keep your recovery code somewhere safe.
How does autofill decide what to fill?
It fills automatically only when exactly one account is linked to the site, and the page isn't asking for a code sent by email or text. Accounts that merely share a site's name are suggested, never filled automatically.
How do emailed codes work?
FactorTwo reads an open Gmail tab on your screen, with no Gmail API and no Google sign-in. It fills a code automatically only when the sender matches the site you're on. This feature is in beta.
Does FactorTwo send my data to you?
No. There are no analytics or servers of ours. The only network connection is to Microsoft OneDrive, and only if you connect it. See the Privacy Policy for the full details.
Which browsers does it support?
FactorTwo is built for Google Chrome, version 116 or newer.
Stop retyping verification codes.
FactorTwo is on its way to the Chrome Web Store.