OTP.pink — offline 2FA authenticator for your browser

Your two-factor codes in the browser’s side panel, next to the site that asks for them. OTP.pink keeps the keys encrypted on your computer, makes no network requests, and reads the key straight from the site’s setup page. It is free.

Get started · How it is secured

No network requests — check it in two minutes

There is no server behind the extension: no account, no sync, no analytics, nothing fetched. You do not have to take that on trust:

1. Open the side panel, right-click inside it and choose Inspect, then the Network tab.
2. For the background: chrome://extensions (or edge://extensions) → Developer mode → OTP.pink → service worker → Network.
3. Unlock, add an account, find a key on a page, copy a code, export. The Network tab lists only the extension’s own files.

The manifest says the same: no host permissions, no webRequest, no content scripts that run on every site, and a content security policy with connect-src 'none'. The steps for Firefox, and the full list of what the extension may do, are on the security page.

This promise is about the extension. The site you are reading counts its visits without cookies — what it records is on the privacy page.

Encrypted by default

The vault is encrypted with a key from your passphrase, and so are the automatic backups and the .pinkotp file you export. Nothing leaves in the clear without a separate confirmation: an unencrypted export, a QR code on screen or a printed recovery sheet each asks first. The vault locks itself after the idle time you choose and when the browser closes.

The key straight from the setup page

Open the panel on a site’s 2FA setup page: OTP.pink looks for the QR code, the otpauth:// link or the key written out for manual entry. When the page hides it — a dialog, a frame, a protected picture — you draw a box around the QR on a picture of the page. A QR in an image, a pasted link and a key typed by hand work too. The ways, in order, are in adding accounts.

Moving from a phone app that exports QR codes? See moving from Google Authenticator.

TOTP (SHA-1, SHA-256, SHA-512), HOTP and Steam Guard codes. Tested with 5,000 accounts in one vault in Chromium, the engine of Chrome and Edge; Firefox has not been measured yet.

If you lose the passphrase — or the browser

The passphrase is never stored: if you lose it, the vault cannot be opened, and there is no reset by e-mail because there is no server. Keep a way back before you need it — a .pinkotp export with its passphrase, or a printed recovery sheet.

Removing the extension removes the vault and its automatic backups; only an exported file brings them back. What saves you in each case is on backups.

What it does not do

• No sync between devices in this version: there is no server to sync through.
• No autofill. Codes are copied, not typed into pages — typing them in would need access to every site.
• Not a passkey provider. That too needs a script on every site, and OTP.pink has no permanent access to any.
• No phone app. It is a browser extension for Chrome, Edge and Firefox.

Before you install

Chrome shows one warning: “Modify data you copy and paste” (Edge and Firefox are still to be checked). It is for clearing a copied code from the clipboard after the delay you choose; OTP.pink never reads the clipboard. There is no “read and change all your data on all websites” — the extension has no permanent access to any site. One optional setting asks the browser for more when you turn it on, and says what first. What each permission is for is on the security page.

Chrome and Edge 116 or later, Firefox 142 or later. Clearing the clipboard is checked in Chrome only. In Firefox, finding the key from the sidebar, the automatic backups and the lock shortcut are still to be checked in a real browser. The interface follows the browser’s language: English, German, Spanish, French, Indonesian, Japanese, Brazilian Portuguese, Russian, and Ukrainian.

Made by 301.st.