VKT Toolkit · October 18, 2026 · 6 min read

How to Password-Protect Your 2FA Secrets in the Browser (2026)

A TOTP secret is the seed behind every 6-digit code an account will ever ask for. Copy it once and you can generate valid codes forever, on any device, without the owner noticing. A leaked password can be changed in a minute; a leaked secret is duplicated in silence.

That secret sits in your browser's extension storage, one click away. Anyone at your unlocked desk — or holding a copy of your browser profile — can read it. LocalBox2FA's optional master password exists for that gap. Here is what it does, what it does not do, and how to use it without locking yourself out.

The Second Key Is Lying in an Open Drawer

2FA assumes the second factor sits where the attacker is not. On a phone, that is behind a screen lock. In a browser extension, the secret is a value in chrome.storage.local, protected by your OS account and nothing else — a thin line when a workstation is shared or a laptop is left open in a meeting room.

LocalBox2FA is deliberately minimal: Manifest V3, one permission (storage) plus a single host permission for the license server — contacted only to activate, validate or deactivate a license key, never with your data — TOTP computed with Web Crypto, no account with us and no analytics. Cross-device sync is optional and off by default; when you enable it, sealed records are mirrored through chrome.storage.sync in your own browser account, and the master password stays on the device. That keeps secrets on your machine by default. It does not keep them from someone using your machine.

What the Master Password Actually Encrypts

It is optional and off by default. Once enabled:

• Only the secret field is encrypted, with AES-GCM and a 256-bit key.
• The key is derived from your password with PBKDF2-SHA256, 600,000 iterations and a random salt. The password itself is never stored.
• The derived CryptoKey lives only in the popup's memory and is never written to storage.

Name, digits, period, algorithm and the added date stay unencrypted in storage. That split is deliberate, but the UI still hides the whole list while the vault is locked — the next section covers exactly that. Encryption runs where the codes are computed, so nothing leaves the device.

Why You Type It Every Time — by Design

No remember-me, no 24-hour unlock, no biometric shortcut. Every popup open starts with the password.

Ask what skipping it would cost: the extension would have to keep the derived key, or a key that unwraps it, in persistent storage. Whoever obtained that value could open your vault without your password — the exact scenario this feature prevents. So the cost is one password per popup, and the benefit is that closing the popup really ends access. Someone who takes your laptop while the screen is locked gets ciphertext, not live codes.

What Happens While It Is Locked

While locked, the popup shows the lock screen and nothing else. The account list is not rendered at all, so you cannot tell which services sit in the vault until you unlock.

That is the deliberate trade-off. Only the secret is encrypted, but half-rendering the list would still reveal which accounts you keep, so the extension covers everything and asks for the password first. Unlock, and codes, search, rename and the 🔐 marker on encrypted records all come back.

Names stay in clear text in storage, so a copied browser profile still exposes them. Keep them boring: "Work mail" is fine; account numbers and PINs do not belong in a name.

Turning It On and Off

Open the popup, go to settings, set a master password. The only rule is that it is not empty — no length, case or symbol requirements. The author chose that on purpose: complexity rules push people toward short, predictable patterns, and a passphrase you can retype daily beats one you cannot.

Turn it off at any time in settings. The key material is deleted and records return to plain text.

Existing Records: No Migration, No Reset

Nothing migrates, nothing is cleared, and no secret has to be pasted again. The storage key is unchanged, so plaintext and encrypted records coexist in one list. Entries added while protection is on are stored encrypted; older ones keep working, without the marker.

Forgot the Password: No Way Back

AES-GCM has no backdoor, and there is no reset link, recovery key or support override. Forget the password and the secrets are gone — support cannot decrypt them.

The only exit is Erase everything, which asks twice and then removes every record. That is the right behaviour for a local tool, and the reason for one habit: export before you enable encryption. Export is free and writes a plain text file of name:secret lines. Keep it offline and treat it like the secrets themselves.

Writing the password down somewhere physical is also reasonable. A local-only tool has no account recovery by definition.

What This Layer Stops — and What It Doesn't

Precisely: it stops a colleague clicking the icon on your unlocked machine, someone reading raw values from a copied profile, and a stolen laptop whose browser data was unprotected. It does not stop malware running as you, a keylogger, a process reading the popup's memory while it is unlocked, or anyone who knows the password. It is not disk encryption and not a substitute for a locked screen.

A second lock on one drawer, not a vault door.

Frequently Asked Questions

Explore more tools in the VKT Extensions catalog, or reach us at [email protected].