Authenticator X
Two-factor codes that stay on your device.
Authenticator X generates the six-digit codes you need to sign in to GitHub, Google, your bank, and anything else that supports an authenticator app. It runs entirely in your browser. There is no account and no server.
It cannot read the websites you visit
Most extensions that fill something in for you ask to read and change your data on every site you visit. This one does not ask for that, and could not use it if it were granted.
It declares no host permissions and installs
no content scripts. Scanning a QR code or filling in a code
uses Chrome's activeTab permission, which Chrome grants for a
single tab, only when you open the extension on it, and only until that tab
navigates somewhere else.
You do not have to take that on trust. Chrome lists every permission an
extension asks for, on the install prompt and on its entry in
chrome://extensions. If this one ever asks to read your data on
all websites, something has changed that should not have.
What it does
- Scans the QR code straight from the page you are setting up
- Imports every account from Google Authenticator in one scan
- Fills a code into a site with one click
- Encrypted backups you can restore anywhere
- A recovery key, for when a master password is forgotten
- Standard
otpauth://export, so you can leave whenever you like
Your accounts are encrypted with AES-256-GCM before anything is written to disk. The key never leaves your device.
Privacy Policy
Last updated: 11 September 2026
Authenticator X does not collect, transmit or sell any of your data. There is no server. Everything the extension stores stays in your own browser profile on your own computer.
What the extension stores
- Your two-factor accounts — the issuer, the account name, and the shared secret needed to generate codes. These are encrypted with AES-256-GCM before they are written to disk and can only be decrypted on the device that created them, using either that device's key or your master password.
- Your preferences — theme, sort order, auto-lock delay, and whether autofill is enabled.
All of this lives in Chrome's local extension storage. None of it is sent anywhere.
What the extension can see
- The page you open the extension on. When you scan a
QR code, the extension takes a picture of the visible part of that tab and
looks for a QR code in it. When you fill a code, it looks for a
one-time-code field on that tab and types into it. Both use Chrome's
activeTabpermission, which Chrome grants only for the tab you invoked the extension on, and only until that tab navigates away. - The extension declares no host permissions and installs no persistent content scripts, so it has no standing access to any website.
Nothing seen this way is stored or transmitted. The screenshot is decoded in memory and discarded.
What the extension does not do
- No analytics, telemetry, crash reporting or usage statistics.
- No advertising, and no advertising identifiers.
- No accounts, sign-in or email collection.
- No selling or sharing of data with third parties, because there is no data leaving your device to sell or share.
- No remotely hosted code. Everything that runs is in the package Chrome installed, enforced by the extension's Content Security Policy.
Data you export yourself
The backup and export features write files to wherever you choose. An
encrypted backup is protected by the password you set for it. A plain-text
otpauth:// export is not encrypted and contains
your secrets in readable form — delete it as soon as you have finished using
it.
Deleting your data
Settings → Security → Delete this vault removes the encrypted vault and its encryption key from the device. Removing the extension from Chrome also removes its storage. Neither is recoverable, and neither needs a request to us, because we never had a copy.
Future versions
A later version will offer an optional account so your vault can sync between your devices. That is opt-in, it does not exist in this version, and this policy will be updated before it ships.