VKT LocalBox2FA
Generate TOTP 2FA verification codes locally by default β optional encrypted cross-device sync stays off until you enable it.
π Free Features
- TOTP code generation (RFC 6238 compatible)
- Works with Google Authenticator, Authy, all standard TOTP services
- 30s countdown with color transitions (blueβorangeβred)
- One-click copy to clipboard
- Save & manage secret keys with custom names; click an account to copy its current code
- Live history β all saved accounts show real-time codes and countdowns
- Search & rename saved accounts
- Safe delete with confirmation dialog
- Duplicate guard β prevents saving same key twice
- Export & import backups β plain text or password-encrypted (independent backup password) β plus bulk clear all records
- Import from otpauth:// links, Google Authenticator migration QR codes and images
- Change the master password anytime
- QR codes hidden until revealed; clipboard auto-clears after 30 seconds; optional idle auto-lock
- QR code display β transfer an account to a phone authenticator
- Optional master password β secrets sealed with AES-GCM 256 (PBKDF2-SHA256, 600k iterations), asked on every open
- Dark mode β follows system preference
- Lightweight, minimal permissions (storage + clipboardWrite + license-server host permission)
β Advanced Features (License)
- Cross-device sync β optional encrypted sync of saved accounts between devices signed into the same browser account. Secrets are uploaded sealed with your master password; sync runs automatically while the popup is open, and only genuine conflicts ask you to choose. Requires the master password and a license.
Is the free version enough?
See pricing & refund policy
3-day trial on request Β· 7-day refund for unused licenses Β· free features stay free after a subscription ends
Installation
- Visit the Chrome Web Store page for LocalBox2FA
- Click Add to Chrome and confirm
- Click the π icon in your toolbar to start using
Security Notes
- π Encryption is opt-in β out of the box, secret keys are stored in extension storage without encryption; turn on the master password in Settings to seal them
- π« No password recovery β the master password cannot be reset, and encrypted records cannot be recovered without it; keep an exported backup β choose the encrypted option and store its password separately
- πΎ Removing the extension = local data loss β accounts stored on this device are erased. If sync is on, a copy remains in your browser account and can be restored after reinstalling by reactivating your license and joining the existing sync with the same master password; use Delete synced data first if you want it gone
- π Export can be encrypted β choose a backup password; the plaintext option is readable by anyone, so store it securely
- π‘οΈ Best practice β Transfer to dedicated authenticator app for production use
Privacy
- β Local by default β all TOTP computation happens locally; saved secrets stay in extension storage unless you explicitly enable sync
- β Optional encryption at rest β once the master password is on, every saved secret is sealed with AES-GCM 256; the key is derived from your password and held in memory only
- β No analytics, no cookies
- β οΈ Optional cross-device sync β if you enable it, sealed records, account names, TOTP settings and the vault's salt/verifier are stored in chrome.storage.sync and carried by your browser account (Google or Microsoft). The master password and license key are never included. Sync is off until you confirm it, and Delete synced data removes the cloud copy
- β οΈ Without a license key there are no network requests β apart from retrying a license release requested while offline. With a license, the extension contacts the license server to activate, re-verify (at most once per 2 h when you open the popup) and release it β carrying your license key, a random install identifier and browser metadata, never your secrets or codes
- β Minimal permissions β storage and clipboardWrite plus one host permission for the license server
Install for Chrome
Install for Edge
View on GitHub
GitHub repository only contains readme documentation for reference. No offline installation packages, source code for end users are not provided. Official installation channel is Chrome Web Store only.
For questions: [email protected]