exte

exte is a browser extension that generates two-factor authentication codes right inside Chrome. I wrote it so I could copy a code with one click and finish signing in without reaching for my phone. The extension has no network permission at all, so the secret keys of your accounts cannot leave your device. The source code is open under the MIT license.

Purpose

I sign in to dozens of panels and services every day, and most of them ask for a second factor. Unlocking the phone, finding the right account in the authenticator app and typing six digits back into the keyboard kept eating time. Some of the browser authenticators I tried wanted an account, synced data to their own servers or asked for broad permissions. I wanted the opposite: no account, no server, no network access, and everything stored encrypted in my own browser.

How it works

On first run the extension asks you to set a password. The password itself is never stored. It is run through PBKDF2-SHA256 for 310,000 iterations to derive a key, and your accounts are encrypted with that key using AES-256-GCM. PBKDF2 turns a password into an encryption key in a way that slows down brute-force guessing, and AES-256-GCM is an encryption mode that protects both the secrecy and the integrity of the data.

Codes follow the TOTP and HOTP standards. TOTP is a time-based one-time password that changes every 30 or 60 seconds, while HOTP is counter-based and moves forward each time it is used. In the popup every account appears as a card, and a bar under the card shows how long the current code stays valid. Clicking a card copies the code to the clipboard.

By default the extension asks for the password every time it opens. In the settings you can relax this to once per browser session, or to an idle period you choose between one minute and 30 days. The session key is kept in a storage area that is cleared when the browser closes and that page scripts cannot read.

Key features

• There are four ways to add an account: scanning a QR code shown on screen, picking a QR image file or pasting one from the clipboard, pasting an otpauth:// link, or entering the details by hand.
• It supports the SHA-1, SHA-256 and SHA-512 algorithms, codes of 6 to 8 digits and periods of 30 or 60 seconds.
• It reads the QR code produced by Google Authenticator's "Transfer accounts" screen directly and tells you which part it has just read when the export is split into several codes.
• You can download a password-protected encrypted backup file and restore it on another device.
• You can also export a plain otpauth:// list to move accounts into other authenticator apps.
• Importing never deletes existing accounts and never creates duplicates.
• It has a search box for long lists, light and dark themes, and an English and Turkish interface.

Technical stack

exte is built on Manifest V3, the current Chrome extension format. I deliberately avoided a build step, npm and bundlers, so the folder in the repository is the extension that runs, written as plain ES modules. There is no background service worker either, because codes are only generated while the popup is open.

QR decoding uses the jsQR library, which I vendored into the repository because Manifest V3 forbids loading remote code from a CDN. Google Authenticator's transfer QR uses a binary format called protobuf. Instead of adding a whole library for a single message schema, I wrote a decoder of about 90 lines myself.

Backup and import live on a separate settings tab instead of the popup. A popup can lose focus and close when a file picker opens, which used to leave operations half finished.

The extension requests only three permissions. storage keeps accounts and settings on the device, activeTab captures the visible tab only when you press "Scan from screen", and clipboardWrite copies the code you click. There are no host permissions and no network calls anywhere in the code.

Use cases

• System administrators and developers who sign in to many panels during the day can use it as a fast authenticator.
• It suits people moving from Google Authenticator to the desktop, or keeping a second copy in case they lose their phone.
• It is designed for privacy-minded users who require that their data never reaches any server.
• It is also a readable example for developers who want to see how a simple, dependency-free Manifest V3 extension is put together.

Privacy and security

You do not need an account, a sign-in or any personal information. Data is stored encrypted in chrome.storage.local and is not included in Chrome sync. There are no analytics, ads, cookies or telemetry.

This design has a deliberate cost: there is no password recovery. If you forget the password or lose your browser profile without a backup, your accounts cannot be brought back, so I recommend keeping an encrypted backup. The plain .txt export is not encrypted and should only be used to move accounts to another app and then deleted.

The code generator is tested against the official vectors in RFC 4226 and RFC 6238 for SHA-1, SHA-256 and SHA-512. The QR path, the Google Authenticator decoder, the encrypted backup round trip and the whole password flow are covered by tests that run with Node.js's built-in test runner and need no dependencies.

Status

The current version is 1.1.0. I have prepared the texts, images and privacy policy needed for the Chrome Web Store submission. Until it is published there, the extension can be downloaded from the repository and loaded in developer mode.