2FAu
DesktopExtensionSecurity
Download
Español
English简体中文EspañolPortuguês (Brasil)日本語DeutschFrançaisРусский한국어ItalianoTürkçePolski
Add to Chrome
Two-factor codes
without the friction.
Free, open-source authenticator for macOS, Windows, Linux and your browser. Codes are generated on your device — no account, no server, no tracking.
Trusted by 40,000+ people
4.8 · 320 ratings on the Chrome Web Store
MIT licensed, reproducible builds
Download for macOS
Add to Chrome
macOS detected · Apple silicon
·
Free, MIT licensed
·
No account required
DESKTOP APP
Lives in the menu bar, never in your way.
A window that opens on a hotkey and closes the moment it has done its job. No dock icon, no window management, no hunting for a phone.
⌘
⇧
2
Summon it from any app
type
Filter down to the account
↵
Code copied, window gone
macOS 12+
Windows 10+
Linux
12 MB · Tauri 2
Menu bar app
Lives in the tray on macOS, Windows and Linux. One global hotkey, codes copied, window gone.
Tauri 2 · 12 MB
Browser extension
The same vault inside Chrome and Firefox. Detects the 2FA field, fills the code, submits.
WASM core
Rust core
OTP, crypto, storage and merge logic live once in Rust and are shared by every surface.
One implementation
SECURITY
Your secrets never leave the device.
The vault is a single encrypted blob on your disk. Codes are computed in Rust and handed to the UI already formatted — the interface never sees a shared secret, and neither does a server, because there isn't one.
AES-256-GCM with Argon2id key derivation
Auto-lock on sleep, on blur, on a timer you set
Optional device-to-device sync over your own network
Reproducible builds, MIT licence, audited dependencies
Read the threat model
app_data_dir/vault.dat
AES-256-GCM
BLOB LAYOUT
2FAU
magic
01
ver
02
kdf
salt
16 bytes
nonce
12 bytes
ciphertext
n bytes
The 6-byte header is self-describing and bound as associated data, so a tampered version or KDF id fails the tag check before anything is decrypted.
KDF
Argon2id
MEMORY
64 MiB
ITERATIONS
3
PARALLELISM
4
github.com/sessions/two-factor
Two-factor authentication
Open your authenticator app and enter the 6-digit code.
7
3
0
1
1
8
2FA
u
GitHub
this site
730 118
alice
Google
451 520
alice@gmail.com
2 accounts
Fill code
↵
BROWSER
Full parity in the tab you're already in.
The extension runs the same Rust core compiled to WebAssembly. It recognises the 2FA field, offers the matching account, and fills the code — without a background service, a login, or a copy-paste round trip.
0
servers contacted
1×
Rust core, two targets
<40ms
from field focus to fill
FEATURES
Everything you need for 2FA.
Nothing you don't. No dashboards, no upsells, no account.
Full feature list
Local-only encryption
AES-256-GCM
Password lock
Argon2id, recovery code
Offline codes
no network, ever
Time drift check
codes stay valid
Zero telemetry
nothing phones home
QR scanner
capture from screen
Import and export
Authy, Aegis, 1Password
Instant search
type, Enter, copied
Local auto-backup
last seven days
Menu bar and browser
one vault, two surfaces
Stop hunting for six digits.
Free, open source, and yours to audit. Install it in under a minute.
Download for Mac
View the source
brew install --cask 2fau
© 2026 2FAu · MIT licensed
How it works
Security
Docs
GitHub
Built with Rust and Tauri 2