Getting started with OTP.pink

Before you install: the warning

Chrome shows one warning when you add OTP.pink: “Modify data you copy and paste” (Edge and Firefox are still to be checked). The extension needs it for one thing — clearing a copied code from the clipboard after the delay you choose, when the panel may already be closed. It never reads the clipboard.

There is no permanent access to the sites you visit: OTP.pink reads a page only where you open it. One optional setting, codes for the site on any tab, asks the browser for the tabs permission when you turn it on, and not before (codes).

1. Open it

Click the OTP.pink button in the toolbar: the codes open in the browser’s side panel, beside the page. In Firefox the same button opens the sidebar. There is no popup.

2. Create the passphrase

The first screen is Create your vault. Your codes are encrypted with this passphrase; it has at least 8 characters and is never stored. If you lose it, the vault cannot be opened — there is no reset, because there is no server that could do one.

So pick one you will remember, and plan a way back before you need it: an exported .pinkotp file with its passphrase, or a printed recovery sheet. Both are on backups.

3. Add the first account

Go to the site’s two-factor setup page, where it shows a QR code, and open the panel there with the toolbar button. It looks for the key on the page — the QR code, a setup link or the key written out — and offers what it found. This is how it works in Chrome and Edge; in Firefox, finding the key from the sidebar has not been checked yet.

If it finds nothing, the next ways are on adding accounts.

4. Confirm the code on the site

The site asks for a code to finish the setup: copy the one ticking in the panel and enter it there. Check it before you leave the setup page — that is the moment a wrong key is easy to fix.

Why a reminder appears

After the first account, the panel shows Export your vault. Removing the extension or the browser erases the vault and its automatic backups; only an exported .pinkotp file brings them back. Later hides the reminder for 30 days.

How the vault is protected, and from what, is on the security page.