TOTPBOX, the authentication companion: Fast 2FA today. Passkeys when they're ready.
TOTPBOX is an authentication companion for your browser. It fills codes where you sign in, keeps secrets encrypted on your device, and tells you when each account can move to a Passkey.
Watch the 36-second tour- AES-256-GCM, encrypted on device
- No passwords, ever
- Open standard (RFC 6238)
Try it: press⌘⇧L
The industry is moving to Passkeys. Your tools aren't.
The browser is where 2FA happens. So that's where TOTPBOX works.
01 · Setup
Catches the setup QR before you reach for your phone
When a site shows a 2FA QR code, an otpauth link, or a plain secret, TOTPBOX reads it from the page, even inside shadow DOM, and offers to save it to your encrypted vault.
02 · Sign-in
Knows which field wants an authenticator code
Layered signals find the right input: autocomplete hints, labels, input shape, and split one-digit boxes. Fields asking for an email or SMS code are left alone on purpose.
03 · Many accounts
Picks the right account on shared logins
Masked hints like p•••@gmail.com, the username you just typed, and sibling domains such as live.com and microsoft.com point to the right account. Per-site memory is stored as hashes, not hostnames.
Set up, store, and fill without leaving the browser.
Capture the setup QR, save it locally, and fill the next 2FA prompt in place.
Built for the transition we actually live in.
TOTP is still everywhere. Passkeys are arriving unevenly. TOTPBOX keeps today's codes fast and moves each account forward when it can.
Codes
TOTP, HOTP, and Steam Guard
Time-based and counter-based codes, Steam's 5-character format, and per-account algorithm, digits, and period.
Shortcut
One chord to fill
Auto, icon, or shortcut mode. ⌘⇧L fills the current code without opening the popup.
Import
Leave Google Authenticator in one scan
Its export QR (otpauth-migration) brings every account across at once.
Add accounts
Camera, image, or paste
QR codes decode on your device from any of the three.
Recovery
Recovery codes, in the vault
Stored per service and encrypted like everything else. 5 sets free, unlimited on Pro.
Backup
Exports are encrypted by default
A password-protected JSON file you control. Plain export only if you ask for it.
Opt-in
Codes from email and clipboard
Off by default. When on, a code from the open message or your clipboard is offered once and kept for 3 minutes in session memory.
Unlock
Touch ID instead of typing
WebAuthn PRF wraps the vault key, so the master password is never saved.
A narrow tool is easier to trust.
TOTPBOX is an authentication companion, not an all-in-one vault. Here is the whole boundary.
PBKDF2 → AES-256-GCM
Encrypt a secret, for real
plaintext
otpauth secret JBSWY3DPEHPK3PXP
ciphertext
—
This runs in your tab with Web Crypto using the vault's parameters. Nothing is sent or stored.
Brute-force protection
Guessing gets slow, then stops
0 failed attempts. Next attempt waits 0s.
From the 3rd wrong password the wait doubles, capped at 60 s. The 10th failure locks unlock for 5 minutes.
Timers you don't have to think about
Short-lived by design
Copied code wiped from the clipboard
Vault locks itself after 5 idle minutes (default)
Auto-lock is configurable from 1 minute to never, and resets on activity. Copied codes are cleared from the clipboard after 30 seconds.
What TOTPBOX stores
- TOTP secrets, encrypted with AES-256-GCM on your device
- Recovery codes you choose to keep
- Per-account Passkey readiness and health notes
What it never stores
- Account passwords or your master password
- Passkey private keys (the OS and browser hold those)
- Unencrypted secrets on any server
Details in the security documentation and whitepaper.
Each account moves forward when the site is ready.
TOTPBOX checks every account against a public passkey directory, tracks where it stands, and walks you through the upgrade with the site's own setup page.
You keep getting codes by email for example.com. It supports passkeys. Set one up?
One nudge per site per week. Sites are counted as salted hashes. TOTPBOX never stores passkey private keys; your OS and browser keep those.
TOTP vs Passkey: what's the difference?
Both are forms of two-factor authentication, but they work in fundamentally different ways. The industry is moving from TOTP to Passkeys, which is why TOTPBOX helps with both.
| Capability | TOTP Standard | Passkey (WebAuthn) |
|---|---|---|
| Standard | RFC 6238 (HMAC-SHA1) | FIDO2 / WebAuthn |
| User action | Type a 6-digit code | Biometric or PIN, automatic |
| Phishing resistant | No, codes can be relayed | Yes, bound to the origin domain |
| Secret storage | Shared secret on both sides | Private key never leaves device |
| Adoption (2026) | Universal | Growing, major services only |
| TOTPBOX role | Stores and encrypts secrets | Tells you when to upgrade |
Most services still require TOTP as a fallback even when Passkeys are enabled. Learn more in the FAQ or the app comparison.
What is TOTP?
TOTP (Time-based One-Time Password) is a two-factor authentication standard defined in RFC 6238. It generates a temporary 6-digit code every 30 seconds by combining a shared secret key with the current time using HMAC-SHA1. Because your device and the server compute the same code independently, no secret is transmitted during login.
- 30sHMAC Ticker
- Each code is valid for one 30-second window, then cryptographically replaced.
- RFC 6238Open IETF
- Open standard used by Google, GitHub, AWS, and thousands of enterprise services.
- AES-256GCM Enclave
- TOTPBOX encrypts secrets with authenticated GCM before anything touches storage.
- Unix time t
- …
- Time step T = ⌊t / 30⌋
- … = 0x…
- HMAC-SHA1(secret, T)
- …
- Dynamic truncation
- …
- mod 10⁶ → code
Free for daily 2FA. Pay only for encrypted backup.
Free
Everything you need to secure your authentication on one device.
- Local TOTP storage
- Passkey readiness checks
- Encrypted export and import
Pro
RecommendedBilled monthly. Cancel anytime.
- Everything in Free
- End-to-end encrypted backup
- Auto migration tracking
- Secret vault backup
Manage your subscription from sync settings after checkout.
Team
For organizations managing secure access together.
- Everything in Pro
- Shared vaults and access control
- Org-wide health dashboard
How Pro sync works
HKDF sync key · AES-256-GCM · server sees ciphertext, IV, checksum
Your vault is encrypted on the device before it leaves. The relay stores a blob it cannot decrypt, and only your devices hold the key.