A 2FA authenticator that runs in your browser instead of your phone. Codes sync to your own server, encrypted with a master password that never leaves the browser.
Chrome and Firefox. Does TOTP, HOTP and Steam Guard, scans QR codes straight off the page, and still works offline.
You'll need Node 20+ and Postgres.
CREATE DATABASE cloudauth;cd backend
npm install
cp .env.example .env # fill in DATABASE_URL, JWT_SECRET, Gmail app password
npm run devWait for both lines before doing anything else, it takes about ten seconds:
Backend running on http://localhost:4000
PostgreSQL connected
- Go to
chrome://extensions - Turn on Developer mode, top right
- Load unpacked → pick the
extensionfolder - Pin it from the puzzle piece icon
Firefox needs a different manifest, see extension/FIREFOX.md.
Whenever you edit an extension file, hit the reload arrow on the card. It won't pick up changes by itself.
Register, grab the code from your email, then create a vault.
The master password is not your login password. Login talks to the server, the master password decrypts your codes. The server never sees it, which also means nobody can reset it for you, so export a backup early.
To add an account, open a site's 2FA page and hit "Scan QR on this page". If the page blocks screenshots, save the QR as an image and scan that instead. Coming from Google Authenticator, just scan its export QR and everything comes across.
Deploying: DEPLOY.md. Change API_BASE in extension/config.js
and the manifest's host_permissions to match, both of them.
Vaults are AES-256-GCM, key from PBKDF2-SHA256 at 600k iterations.
No tests yet. If you touch the crypto or the sync code, check it against the RFC vectors first, the bugs there don't throw, they just write bad data.
If the popup misbehaves, right-click it and Inspect. It has its own console.