Installation status
For development and source review, clone the repository, run npm ci and npm run build:chrome, then load .output/chrome-mv3 as an unpacked extension on the browser’s extension-management page. Only install builds you produced yourself or received from a source you trust.
Before contacting support
- Confirm OTPManager is updated and reload the affected tab after an extension update.
- Check that the vault is unlocked and the account is bound to the actual website hostname.
- Open the browser’s extension site-access setting and confirm access is allowed for the affected site.
- Compare your device time with an automatic network time source; TOTP codes fail when the clock is materially wrong.
- For sync problems, test the configured endpoint and verify its URL, credentials, bucket/path, and browser permission prompt.
Autofill does not appear
Some sign-in pages place fields in restricted frames or closed shadow roots that extensions cannot safely inspect. First allow site access, reload the page, focus the code input, and use OTPManager from the toolbar. You can also use the field-recognition workflow to explicitly mark or ignore a field.
Sync or restore fails
Record the exact error and whether you use WebDAV or S3. Check HTTPS certificates, endpoint path, object-store region, system time, and whether another device changed the remote vault. Do not delete remote data before exporting a known-good local vault or downloading a provider-side backup.
Forgotten master password
OTPManager has no account server and cannot reset or recover your master password. If an unlocked session is still available, export or move the data before locking it. Otherwise, recovery requires an accessible backup and the correct password or a previously configured quick-unlock method.
What to include in a report
- OTPManager version and installation source.
- Browser name and version, operating system, and whether the site runs in a normal or private window.
- The affected website hostname, unless it is sensitive.
- Numbered reproduction steps, expected result, actual result, and exact non-secret error text.
- A screenshot with usernames, codes, QR values, tokens, endpoint paths, and account details redacted.
For a suspected vulnerability, follow the private reporting guidance on the security page rather than posting it publicly.