2FAu Browser Extension — 2FA codes in Chrome, Edge & Firefox

Português (Brasil)

English 简体中文 Español Português (Brasil)日本語 Deutsch Français Русский 한국어 Italiano Türkçe Polski

BROWSER EXTENSION

One source. Two browsers. No servers in between.

The same Rust core, compiled to WebAssembly and running in the tab you're already in. Chrome, Edge and Firefox are built from one manifest, so a feature never lands on one and quietly skips the other.

Add to Chrome

Edge

Firefox

Chrome

116+

Edge

116+

Firefox

128+

WHAT IT DOES

Eight things, and nothing that phones home.

Every action below is something you trigger. The extension has no persistent content script and asks for no host permissions, so it cannot watch the pages you visit.

Autofill on a shortcut

Press ⌘⇧Y (Ctrl+Shift+Y) and the code for the current site is inserted at the caret. It only writes into a focused, editable text field, and it never submits the form for you.

⌘⇧Y · Ctrl+Shift+Y

Copy from the right-click menu

Right-click anywhere → 2FAU → pick an account and its code is on the clipboard. The badge flashes green. Works on pages the extension cannot script, too.

contextMenus

The popup, on a key

⌘⇧U (Ctrl+Shift+U) opens the full vault: search, copy, add, reorder — the same React UI the desktop app runs, not a cut-down build.

⌘⇧U · Ctrl+Shift+U

Scan a QR from the tab

Enrolling somewhere new? Capture the QR straight off the visible page from the popup. The grant is carried by your click on the button.

activeTab

Encrypted, chunked storage

The sealed vault is base64-chunked across chrome.storage.sync at 6 KB a chunk. Read the raw storage and you get a manifest and opaque blobs — nothing legible.

6144 chars/chunk

A revision guard, not a last-write-wins

The manifest is the commit point. If a second browser wrote while you did, the Rust merge runs — newest-wins with tombstones — instead of one of you losing an account.

twofau_core::merge

Auto-lock you configure

The derived key lives in chrome.storage.session, never the passphrase, and a chrome.alarms timer clears it after the interval you set in Options.

chrome.alarms

Optional desktop bridge

Point the extension at the desktop app over loopback and they sync directly. It is an optional permission for 127.0.0.1 only, off until you turn it on.

127.0.0.1 · opt-in

CHROME / EDGE vs FIREFOX

Where the two builds actually differ.

Both are MV3 and both ship the same UI and the same WASM core. Gecko needs five concessions, and the Firefox manifest is generated from the Chrome one so they cannot drift apart.

CHROME / EDGE

FIREFOX

Background

service worker

event page · module scripts

Clipboard

offscreen document

direct DOM write in the background

Options page

options_page

options_ui · opens in a tab

offscreen permission

required

dropped — unknown to Gecko

Minimum version

Chrome 116

Firefox 128

Distribution

Chrome Web Store

AMO, signed .xpi

scripts/firefox-manifest.mjs derives the Gecko manifest from the Chrome one — a pure function, unit-tested, so a permission added for Chrome shows up in the Firefox build or fails the suite.

PERMISSIONS

Seven permissions. No host access.

The install prompt is short on purpose. There is no "read your data on all websites" line, because the extension never asks for one.

storage

Holds the sealed vault chunks and your settings.

contextMenus

Builds the right-click menu of recent accounts.

activeTab

A one-shot grant on the tab you act on — never standing access.

scripting

Inserts the code into the focused field when you press the shortcut.

alarms

Runs the auto-lock timer that clears the session key.

offscreen

Chrome only: a hidden document used purely to write the clipboard.

notifications

Reports a failed copy or fill instead of doing nothing.

One optional permission: http://127.0.0.1/*

Requested only if you switch on the desktop bridge, and scoped to loopback so it cannot reach the network. Leave it off and the extension is entirely self-contained.

INSTALL

Add it to the browser you actually use.

Free, MIT licensed, and the same vault whether you land here from Chrome, Edge or Firefox.

v0.1.0 · MV3 · no account required · build it yourself from source

How it works

Security

Docs

GitHub

Built with Rust and Tauri 2