Questions, answered.

Twofold is a free authenticator extension for Chrome. It creates the six-digit sign-in codes that websites ask for when two-step verification is on, stores passkeys, and can fill codes into sign-in pages for you. Everything is kept in an encrypted vault on your device.

Yes. There are no ads, no premium plan, no trial and no account to create. It’s free for good.

No. Twofold creates your codes right in Chrome. If you also want them on a phone, use Transfer to phone to show QR codes that phone authenticator apps can scan.

Yes. Twofold uses the same open standard (TOTP, RFC 6238), so any website that works with an authenticator app works with Twofold. You can even keep an account in both places.

Chrome 116 or newer on Windows, macOS, Linux and ChromeOS. Twofold also runs in other browsers based on Chrome.

Yes. Codes are calculated on your device from the current time, so no internet connection is needed. Only sync needs a connection.

Turn on two-step verification in a website’s security settings and choose “authenticator app”. When the site shows a QR code, open Twofold and press Scan. Then type the code Twofold shows into the website to finish. Our step-by-step guide walks through it.

Choose Add account → Enter setup key in Twofold and type the service name, your account name and the key. Spaces don’t matter, and a live preview shows the code before you save.

Yes. Most authenticator apps can export accounts as a file or as QR codes. Open Import in Twofold and add the file, or scan or upload the export QR codes. You choose which accounts to bring across, and duplicates are skipped.

We recommend it. It means only you can unlock your vault, and it’s required for sync. Pick something long you’ll remember, such as a few random words, and write it down somewhere safe.

When you turn on Detect 2FA fields on websites in Settings, Twofold notices code fields on sign-in pages. With “Ask me first” it shows a small panel with the right account on top; with “Fill automatically” it enters the code for you.

Only if you turn it on and allow it. Even then, pages are checked on your device to find code fields, and nothing about them is stored or sent anywhere.

Twofold only suggests an account on the website it belongs to and reads the part of the address that decides who owns a site. Lookalike addresses get nothing. Picking an unlinked account needs a deliberate second click. Learn more.

When you pick an account that isn’t linked to the website you’re on, Twofold asks for a second click to make sure you meant it. Accounts linked to a site fill with one click.

A passkey replaces a password with a cryptographic key that only works on the real website. It can’t be phished or leaked from a website. See passkeys explained.

They work on websites that support passkeys. A few sites only accept passkeys stored on a hardware security key; for those, choose “Use another device or browser” in the Twofold panel.

Yes. Every Twofold passkey panel has a Use another device or browser button that hands over to Chrome’s own options, including your phone.

Turn on Chrome Sync or connect Google Drive in Settings → Sync & backup, or export an encrypted backup file. On a new computer, install Twofold and restore. Our backup guide explains the options.

No. Your vault is encrypted with your master password on your device before it’s uploaded, so only scrambled data is stored.

Twofold stores its data in a private app folder that only Twofold can see; it can’t see your other files. It also keeps a daily snapshot and holds on to the last ten, so you can restore an earlier state.

As many as you need. Chrome Sync holds roughly 250 accounts; for more, use Google Drive.

Your vault can’t be opened without it, and nobody can reset it, not even us. That’s exactly what keeps it private. Keep an encrypted backup and your password somewhere safe.

No. There are no servers, analytics, ads or tracking. Read the privacy policy for details.

Codes depend on the time, so check that your computer’s clock is set automatically. Make sure you picked the account for that website, and try again if the code was about to change.