Add a 2FA account from a page, a picture or a key

The ways below go in the order OTP.pink tries them. Most setup pages stop at the first. The steps on the page are described for Chrome and Edge; in Firefox, finding the key from the sidebar has not been checked yet.

1. Open the panel on the setup page

Open OTP.pink on the tab with the site’s 2FA setup page: its toolbar button, the context-menu item OTP.pink: find the 2FA key, or your shortcut. It reads the page for a QR code, an otpauth:// setup link and a key written out for people who cannot scan, and shows what it found. Add puts the account in the vault.

The page is read without a click on it, so a QR in a dialog stays where it is.

2. The QR appeared later

Some sites show the QR only after a step, in a dialog. Press Find on the page in the panel to look again. While the tab keeps OTP.pink’s access, the panel also looks again by itself when a page loads there.

3. A QR it cannot read directly

A QR in another site’s frame, or drawn so that the page will not hand it over, is cut from a picture of the visible tab. If the panel says a picture that may be the QR is not in view, scroll to it and look again; if the QR is too small, zoom the page in.

4. Select the QR on the page

Still nothing: Select the QR on the page, then draw a box around the code with the mouse. The box is drawn on a picture of the page taken before, so a dialog that closes on a click does not take the QR with it. Esc cancels.

5. A picture or a link from elsewhere

• Paste a QR picture or an otpauth:// link into the panel with Ctrl+V.
• Right-click a picture on any page → Add to OTP.pink.
• Drop a file in Import from another app, under Import and export in the panel’s header.

Pictures are read in PNG, JPEG, GIF, WebP and BMP. AVIF, HEIC and TIFF are not: save the picture as PNG first.

6. Only a key

Some sites show only the key. Add in the panel opens the form: the service, the account name and the secret key. Most sites use TOTP with a new code every 30 seconds; the algorithm, the digits and the period are under Advanced, for the rare site that changes them. The form shows the current code before you save.

What it does not do quietly

• The same key twice. A key already in the vault is not added again without your say: the form names the account that holds it, and Add anyway is a separate choice. In a list, such keys come unchecked.
• Browser pages. The browser does not let extensions read its own pages — settings, extension stores, the PDF viewer. There, add the QR as a picture.

Check before you leave

Compare the code ticking in the panel with what the site asks for, and finish the setup with it. A wrong key is easy to replace while the setup page is still open.

Moving many accounts from a phone app is on moving from Google Authenticator. Using the codes day to day is on codes.