Copy 2FA 0.4.0

Grab an older code when two show up at once.

• Recent codes: click the menu bar icon → Recent Codes… to see the last five codes from Mail and Messages, newest first, each with who sent it, where it came from and how long ago it arrived. Pick one with the arrow keys and Return, or click it.
• One entry per code: a code sent by both email and text is listed once.
• Its own shortcut, if you want one: set it in Settings → General. It's off until you record one, so Copy 2FA doesn't take over another key combination by itself.
• Private like everything else: the list follows Show the code in the notice, stays out of screenshots and screen sharing, and closes when you click away, lock the screen or after a minute. Its codes are cleared when it closes.
• ⌃⇧C is exactly as fast as before. Copying the newest code still stops at the first one it finds.

No new permissions, and still no internet access.

Install or update

1. Download Copy-2FA.zip below and unzip it.
2. Quit Copy 2FA if it's running, then move the new Copy 2FA into Applications, replacing the old one.
3. Open it and press ⌃⇧C the next time a code arrives.

The first time you open it, macOS may say Apple couldn't verify it, because Copy 2FA isn't notarized yet. Go to System Settings → Privacy & Security and click Open Anyway. For the same reason, macOS may ask again for Mail access, and if you read texts, you may need to turn Copy 2FA off and on again in Full Disk Access.

Runs on macOS 14 or later, on Apple silicon and Intel Macs.

SHA-256 of Copy-2FA.zip: a3d5b4f9172c65e7bf214b47ae2a0735982ad6f5b0e4c3d9283a1007bb03f873

What's next is on the roadmap. If Copy 2FA saves you time, starring the repo helps other people find it.

Copy 2FA 0.3.0

Code Caller is now Copy 2FA.

• New name: a simpler name that says what the app does. Your settings, permissions and authenticator accounts carry over.
• Counter-based codes: the authenticator now supports counter-based (HOTP) accounts as well as time-based ones, and imports them from otpauth links, Google Authenticator, Aegis, 2FAS and andOTP instead of skipping them. Each code's counter is saved before the code is copied, so a code is never given twice.
• Import from 2fa: brings over the keys from the ~/.2fa file of the rsc/2fa command-line tool, so they get Touch ID and keychain encryption instead of a plain-text file.
• Add Accounts menu: importing a file, importing from 2fa, pasting and entering a setup key are now together in one menu.
• Website and README: a new one-screen website, and a README with screenshots, a comparison with rsc/2fa and an FAQ.
• Windows license notices: the Windows preview now ships with the license notices for the .NET runtime it includes.

Install

1. Download Copy-2FA.zip below and unzip it.
2. Move Copy 2FA to your Applications folder and open it.
3. Allow Mail access when asked, then press ⌃⇧C the next time a code arrives.

The first time you open it, macOS may say Apple couldn't verify it. That's because Copy 2FA isn't notarized yet. Go to System Settings → Privacy & Security and click Open Anyway.

Runs on macOS 14 or later, on Apple silicon and Intel Macs.

SHA-256 of Copy-2FA.zip: 0963dcc307babdd978fd4d1eddc1c59f45505a980ab07f14cb6309f2f9589bf8

If Copy 2FA saves you time, starring the repo helps other people find it.

Copy 2FA for Windows 0.2.0 (preview)

A preview of Copy 2FA for Windows, now under its new name.

• New name: Code Caller is now Copy 2FA. The app is Copy2FA.exe.
• Counter-based codes: the authenticator supports counter-based (HOTP) accounts as well as time-based ones.
• Import from 2fa: brings over the keys from the .2fa file of the rsc/2fa command-line tool.
• License notices: each download now includes the license notices for the .NET runtime built into the app.

Install

Download Copy-2FA-Windows-x64.zip for most PCs, or Copy-2FA-Windows-arm64.zip for Snapdragon and other Arm PCs. Unzip it somewhere it can stay, then run Copy2FA.exe.

The first time you run it, Windows may say Windows protected your PC. That's because Copy 2FA isn't code-signed yet. Click More info, then Run anyway.

Needs Windows 10 version 2004 or later, or Windows 11. See the Windows README for details.

SHA-256:

• Copy-2FA-Windows-x64.zip: 6c250d1ea9d430833c67d7b6f51999d4386fd4e0db981e17594140e6f1be3d64
• Copy-2FA-Windows-arm64.zip: 8df4f1ec79a625c7e5ff053169dc6a67cffb1f4338a13c7e6f6bbf7a46e25ea0

Code Caller 0.2.0

Codes from texts and authenticator apps, not just Mail.

What's new

• Messages: finds codes in texts and iMessages too, including passcodes texted by Duo and banks. It's off until you turn it on in Settings and give Code Caller Full Disk Access. The sandbox still blocks every other file, including your Messages attachments.
• Authenticator: press ⌃⇧A, confirm with Touch ID, type a few letters and press Return to copy a code. Secrets stay in your keychain, are never synced, and lock again on their own.
• Imports: bring accounts over from Apple Passwords, Google Authenticator, 1Password, Bitwarden, Aegis, 2FAS and andOTP, or from QR code screenshots, otpauth:// links and setup keys. The README explains how for each app, including Authy and Duo.
• Source in the notice: shows where each code came from, like Copied from GitHub · Mail · just now, and slides in from under the menu bar.
• Mail's Junk folder is now checked too.
• Smarter detection: promo codes like SAVE20 and everyday texts like "zip code 94110" are no longer copied.
• Settings: now in General and Authenticator tabs. Mail and Messages can each be turned on or off.
• Hardened by a full code review and stress tests: thousands of damaged emails, texts and import files go through every parser on each build.

Install or update

1. Download Code-Caller-0.2.0.zip below and unzip it.
2. Move Code Caller to your Applications folder, replacing the old one, and open it.
3. To get codes from texts, open Settings, turn on Messages and follow the Full Disk Access steps.

Because releases aren't signed yet, macOS treats each version as a new app. It may ask again whether Code Caller can control Mail.

About the security warning: The first time you open Code Caller, macOS may say Apple couldn't verify that it's free of malware. That's not because anything is wrong with the app. Apple charges developers $99 a year to verify their apps, and Code Caller hasn't paid that fee yet. The code is fully open source, so you can read every line or build the app yourself. To open it, go to System Settings → Privacy & Security and click Open Anyway.

Verify the download

SHA-256 of Code-Caller-0.2.0.zip:

a636fe3fe604419c929c1d7b87f255d71ef8910d4c77e65a9aed9f70e3fd525c

shasum -a 256 Code-Caller-0.2.0.zip
codesign -d --entitlements - "/Applications/Code Caller.app"

The second command lists everything the app is allowed to do: the App Sandbox, Apple Events to Mail, the Messages database and files you pick to import. There's no network access.

On Windows?

A Windows preview with Outlook, Thunderbird and the authenticator is available as a separate release.

Code Caller 0.1.0

The first release of Code Caller: copy your newest 2FA code from Apple Mail with one shortcut.

What's in it

• Copy your newest verification code from Apple Mail with one shortcut (⌃⇧C by default).
• Finds numeric, grouped and letter-and-number codes in English, Spanish, French, German, Chinese, Japanese and Korean emails.
• Fetches new mail and looks again when a code hasn't arrived yet.
• Keeps codes off Universal Clipboard and out of clipboard managers, and clears them after a minute.
• Shows a notice with the code and its sender that stays out of screenshots and screen sharing.
• Settings for the shortcut, how far back to look, clipboard clearing, and opening at login.
• Runs in the App Sandbox with no network access.
• Universal app for Apple silicon and Intel Macs running macOS 14 or later.

Install

1. Download Code-Caller-0.1.0.zip below and unzip it.
2. Move Code Caller to your Applications folder and open it.
3. In the welcome window, click Allow… so Code Caller can read Mail. Then press ⌃⇧C whenever a code arrives.

About the security warning: The first time you open Code Caller, macOS may say Apple couldn't verify that it's free of malware. That's not because anything is wrong with the app. Apple charges developers $99 a year to verify their apps, and Code Caller hasn't paid that fee yet. The code is fully open source, so you can read every line or build the app yourself. To open it, go to System Settings → Privacy & Security and click Open Anyway.

Verify the download

SHA-256 of Code-Caller-0.1.0.zip:

1d2098090d2416b55d109958d9db77ac2be684e274fd9c5a4c71e3034cd049f9

shasum -a 256 Code-Caller-0.1.0.zip
codesign -d --entitlements - "/Applications/Code Caller.app"

The second command lists everything the app is allowed to do: the App Sandbox and Apple Events to Mail, with no network access.

Prefer to build it yourself? See Build from source.

Code Caller for Windows 0.1.0 (preview)

The first preview of Code Caller for Windows.

Preview: everything that finds codes and reads exports is covered by 189 automated tests, and CI builds every version on Windows. The app itself hasn't been tried on many PCs yet, so please report anything that doesn't work.

What it does

• Ctrl+Shift+C copies your newest 2FA code from Outlook (classic) or Thunderbird, including junk folders, and shows where it came from.
• Ctrl+Shift+A opens the built-in authenticator after Windows Hello. Type a few letters and press Enter to copy a code.
• Imports authenticator accounts from Google Authenticator, Apple Passwords or Safari, Bitwarden, Aegis, 2FAS and otpauth:// links.
• Codes stay out of clipboard history (Win+V) and the cloud clipboard and clear themselves after a minute. The notice stays out of screenshots and screen sharing.
• No networking code at all, and no telemetry.

It can't read text messages, the new Outlook for Windows, or mail you only read in a browser. The Windows README has the details.

Install

Download the zip for your PC: x64 for most PCs, Arm64 for Snapdragon and other Arm PCs. Unzip it, put CodeCaller.exe somewhere it can stay, and run it. Nothing else needs to be installed. It needs Windows 10 version 2004 or later, or Windows 11.

About the SmartScreen warning: The first time you run Code Caller, Windows may say Windows protected your PC. That's not because anything is wrong with the app. Code Caller isn't code-signed, because a code signing certificate costs money and Code Caller hasn't bought one. The source is fully open, so you can read every line or build the app yourself. To run it, click More info, then Run anyway.

Verify the download

SHA-256:

0d406055760732ac771b097da116cd92016b44e38166c186e47953bb554803c1  Code-Caller-Windows-x64-0.1.0-preview.zip
ed6f7d051151e210ce957b3a3b279a3d190e73bdda4152a0ff217d1be31641b5  Code-Caller-Windows-arm64-0.1.0-preview.zip

Get-FileHash Code-Caller-Windows-x64-0.1.0-preview.zip

These are the exact builds GitHub Actions made from the Windows code in this release. You can also build it yourself with the steps in the Windows README.