Encrypt before saving
AES-256-GCM encrypts the vault; Argon2id makes offline password guessing more expensive.
Encrypted locally · Sync where you choose · Open source
Keep your codes in the browser.No OTPManager account required.
OTPManager encrypts the TOTP vault on your device. If you need it on more than one device, connect storage you already control; the developer never handles the sync traffic.
- No account to create
- No usage data uploaded
- Full export available
AES-256-GCMEncrypted locally
Daily use
Add a code, use it on the right site, and keep a backup you control.
Web pages only get the generated code needed for filling. The vault stores encrypted data, and every requested permission maps to a visible feature.
Plaintext is not written to persistent storage
Scan only when asked
A scan reads the current tab after you start it and decodes supported otpauth://totp values in memory.
Show codes on the right site
Accounts match the real hostname, with manual field marking for unusual sign-in pages.
Choose where sync goes
The browser connects directly to your WebDAV or S3-compatible storage.
Take the backup with you
Import, export, and encrypted history snapshots give you a way back after a move or mistake.
Unlock with device verification
Supported browsers can use WebAuthn PRF to unlock the same vault without storing the master password.
First run
Bring in your codes, then decide whether you need sync.
- 01
Import or add
Scan a QR code, paste an otpauth URI, or enter a Base32 secret.
- 02
Match sign-in sites
Bind the real hostname and mark the code field when a page needs extra help.
- 03
Decide on sync
Keep everything on this device, or connect your own WebDAV or S3 storage.
Security boundary
There is no OTPManager account server holding your vault.
Codes are processed in the browser. When sync is enabled, encrypted data goes straight to the storage provider you configured; the developer does not proxy it or add advertising and analytics SDKs.
Read the security architectureGCM protects confidentiality and integrity.
A 64 MiB memory setting raises offline guessing cost.
No behavioral profile and no sale of personal information.
Version, algorithm, and compression parameters are authenticated.
Current build status
A separate build for each browser, with one shared security core.
The repository produces MV3 builds for Chrome, Edge, Firefox, and Safari. Store releases are still being prepared.
ChromeChromium · MV3
Preparing releaseEdgeChromium · MV3
Preparing releaseFirefoxGecko · MV3
Preparing releaseSafariWebExtension · MV3
Preparing releaseBefore you install