MFA Authenticator
TOTP authenticator + backup codes - AES-encrypted, fully offline.
TOTP codes and backup codes, encrypted on your device
Add an account by scanning its setup QR code with the camera, pasting the otpauth:// URI or typing the secret, and the six-digit code ticks over every thirty seconds exactly as it would in Google Authenticator or Authy. Eight-digit codes, 60-second periods and SHA-256 or SHA-512 are supported for the few services that use them. Each entry also holds the recovery codes a service hands out at setup, with a box to mark each one used, plus the account name, URL and notes.
The vault is kept in this browser's local storage, encrypted with AES-256-GCM under a key derived from your passphrase with PBKDF2-SHA256 at 600,000 iterations. The key lives in memory only: closing the tab locks the vault, and there is no recovery if the passphrase is forgotten. Because the data is tied to one browser profile, back it up: the export produces a password-protected .mfavault file that imports on another device, or a plain-text file for printing. Clearing site data deletes the vault.
A share link bundles chosen TOTP entries, encrypts them with a password you set and puts the ciphertext in the link after the #, the part of a URL that is not sent to any server. Links can expire after 1, 7 or 30 days and can be revoked; the revocation is recorded locally and, if the network allows, on our server under a token derived from the ciphertext, so a recipient on another device is cut off too. On opening, the page makes one HEAD request to its own origin to measure your device clock, since a clock a minute out is the usual reason codes are rejected.
Frequently asked questions
Where are my secrets stored?
In the local storage of this browser profile, as AES-256-GCM ciphertext. They are not synced anywhere, which also means a different browser or device does not see them unless you import a backup.
What happens if I forget the passphrase?
The vault cannot be opened; the key is derived from the passphrase and is never stored. Restore from a .mfavault export if you have one, otherwise re-enrol each service using its recovery codes.
Can this replace my phone authenticator?
It can generate the same codes, but a browser profile is easier to lose than a phone app with cloud backup. Keep an encrypted export somewhere safe and keep the services' recovery codes outside the vault as well.
Is a share link safe to send over chat?
The link carries the secrets in encrypted form, so send the password by a separate channel. Anyone holding both the link and the password can generate codes for those accounts until the link expires or is revoked.
Why is a code being rejected?
Most often the device clock is wrong; the page measures and corrects for that, and warns when the clock is more than a few seconds out. Otherwise check the secret was entered exactly, including every character.