Encrypted on your device
Your accounts and passkeys are stored in Chrome’s extension storage, encrypted with AES-256-GCM, a widely trusted encryption standard. Nothing is stored in plain text.
Security & privacy
Built so we never see your data.
Twofold has no servers, no accounts and no analytics. Your secrets are encrypted on your device, and only you hold the key. Here’s exactly how it works.
A master password only you know
Set a master password and the encryption key is derived from it. Unlocking takes deliberate, slow math, so guessing passwords is impractical, and repeated wrong attempts are slowed down further. The unlocked key is kept in memory only.
End-to-end encrypted sync
Chrome Sync and Google Drive only ever receive data that was encrypted with your master password on your computer. Google can’t read it, and neither can we.
No servers, no tracking
Twofold has no backend of its own: no analytics, no ads, no telemetry. Nothing leaves your computer unless you turn on sync.
Works offline
Codes are calculated on your device from the current time using the open TOTP standard (RFC 6238). No connection, no dependency on anyone.
On the web
Autofill that can’t be fooled.
Filling codes for you is only safe if the extension knows the real website from a fake one.
Real sites only
Each account belongs to specific websites. Twofold reads the part of the address that decides who owns a site, so mybank.com.secure-login.net is never mistaken for mybank.com.
A deliberate second click
Choosing an account that isn’t linked to the current site needs a second, confirming click, with a warning. That pause catches most phishing attempts.
No hidden-button tricks
Twofold’s panel on web pages ignores clicks when it has just appeared, or when a page tries to cover it or make it invisible (clickjacking).
Everyday protection
Small things that add up.
Auto-lock
Lock after a period of inactivity, when the browser closes, or whenever your computer locks or sleeps.
Clipboard clearing
Copied codes can be wiped from the clipboard after the delay you choose.
Privacy mode
Hide codes until you hover over them, handy when sharing your screen.
Secrets stay secret
Showing an account’s secret key, transferring accounts to a phone or exporting unencrypted links asks for your master password first. Websites only ever see six-digit codes.
Least access
Access to websites is optional and only requested when you turn on autofill or passkeys. Google Drive access is limited to Twofold’s own hidden folder.
Technical details
| Vault encryption | AES-256-GCM with a random 256-bit data key |
|---|---|
| Master password | PBKDF2-SHA256 with 600,000 iterations wraps the data key; the unlocked key lives in session memory only |
| Sync | The same encrypted envelope is stored in Chrome Sync or a Google Drive app-data folder (drive.appdata scope) |
| Codes | TOTP (RFC 6238), HOTP (RFC 4226) and Steam Guard; SHA-1, SHA-256 and SHA-512 |
| Passkeys | WebAuthn with ES256 keys, stored in the encrypted vault |
| Code | All code ships inside the extension; no remote code, strict content security policy |
Permissions, explained
| Storage | Keeps your encrypted vault and settings on your device. |
|---|---|
| Clipboard | Copies codes when you click them, and clears them later if you ask. |
| Current tab and scripting | Lets Scan and Fill work on the page in front of you, only when you ask. |
| Timers and idle detection | Run auto-lock and scheduled sync, and lock when your computer locks. |
| Right-click menu | Adds “Fill 2FA code” and “Scan QR code on this page”. |
| Google sign-in | Used only if you connect Google Drive. |
| Website icons | Shows each site’s icon next to its account, from Chrome’s local cache. |
| Access to websites (optional) | Requested only when you turn on smart autofill or passkeys. Pages are checked on your device and never sent anywhere. |
What Twofold can’t protect against
We’d rather be honest than impressive. No authenticator can fully protect you if:
- Your computer has malware. Software that controls your computer can read what you see and type. Keep your system and browser up to date.
- You forget your master password. Nobody can recover it, us included; that’s what keeps your vault private. Keep an encrypted backup and write the password down somewhere safe.
- Someone uses your unlocked computer. Set a short auto-lock time if others can reach your computer.
Read our privacy policy for exactly what is stored and when anything leaves your device.
Private by design.
Free, offline-ready and encrypted on your device. Add it to Chrome in seconds.
Add to ChromeIt’s free- No ads
- No tracking
- Works offline