v0.3.0

Adds support for browsers with no push service. The zip below is built by CI from this tag.

Install

1. Download the zip and extract it
2. chrome://extensions → Developer mode → Load unpacked → pick the folder
3. Click the extension icon and follow the setup guide

What changed since v0.2.0

Browsers built on ungoogled-chromium now work. Helium, Thorium and similar strip out Google's FCM, and Chrome's Push API is FCM — so pushManager.subscribe() can never succeed there. Previously the extension detected that and told you to switch browsers.

Those browsers now get a second transport: the extension holds a WebSocket open to the relay and codes are written down it. Setup is identical, and nothing extra is stored — holding the socket is the registration. The code passes through a Durable Object's memory and is never written to storage, so the "we never store codes" property is unchanged.

Measured at 216ms from the phone posting a code to it arriving in the browser.

It is second-best, not equivalent. Push wakes a suspended service worker by design; a socket cannot. If the worker is evicted and a code arrives before the one-minute heartbeat re-establishes the connection, that code is lost. Chrome, Edge, Brave and Vivaldi use push and have no such window.

Adds the alarms permission, which is what re-establishes the connection after the worker is evicted — the only thing that survives eviction.

Known limitations

Unchanged from v0.2.0: creating the iPhone automation is manual and cannot be automated by anyone; iOS forces a notification each time it runs; codes reach the relay over TLS but are not end-to-end encrypted, and are never written to disk or logged. Locked-phone reliability is still unmeasured — see docs/SPIKES.md.

v0.2.0

Prebuilt Chrome extension, ready to load unpacked. No Node or pnpm needed — the zip below is built by CI from this tag, so it matches the source exactly.

Install (Windows)

1. Download the zip below and extract it
2. Open Chrome — not Helium, Thorium, or other ungoogled-chromium builds. They remove FCM, and Chrome's Push API is FCM, so codes can never arrive
3. chrome://extensions → Developer mode → Load unpacked → pick the extracted folder
4. Click the extension icon and follow the setup guide

Setup takes about two minutes and is mostly on your phone. There is a 90-second walkthrough video in the guide.

Try it without your phone

Open the test page, paste your pairing code, and press Send code. The field fills in about half a second. This exercises everything except the iPhone automation.

What changed since 0.1.0

• Codes now autofill. Previously every code showed a pill you had to click, because silent filling required a domain-bound SMS sigil that almost no service sends. Filling is now granted by focus — if the caret is in the field, or an OTP field was focused in the last minute, or you opted the site in. A domain mismatch still refuses to fill and warns.
• Setup diagnoses itself. "No codes yet" now distinguishes a live pairing from a dead one and points at the missing automation, which is the step people skip.
• Walkthrough video on the setup page and in the guide.
• Corrected the shortcut name. iOS lists an imported shortcut by its filename, so it appears as sms-code-bridge — every screen used to say "OTP Bridge", which is not a thing you can find on your phone.
• Deep link to the Automation tab, removing two steps from the only part of setup that cannot be automated.
• Security: pages carrying a pairing token now send no-store, no-referrer and a strict CSP.
• Browsers with no push service are detected and named, instead of blaming the relay.

Known limitations

• Creating the automation is manual. Apple allows sharing shortcuts but not automations; this was researched exhaustively and there is no mechanism, for anyone.
• iOS forces a notification each time the automation runs. It cannot be disabled.
• Codes reach the relay over TLS but are not end-to-end encrypted — Shortcuts has no crypto actions. They are never written to disk or logged. See PRIVACY.md.
• Locked-phone automation reliability is not yet measured. See docs/SPIKES.md.

v0.1.0 — superseded

Superseded by v0.2.0.

The build that was attached here was produced from later code than this tag, so it has been removed rather than left as a download that disagrees with its own source. Use v0.2.0.