TOTP in the browser: extensions, web apps, and what's actually safe

The login prompt is on your screen. Your phone is across the room, in a bag, or at three percent — and the six-digit code wants to be typed now. Which raises the question every desktop-bound person eventually asks: can the second factor live in the browser you are logging in from?

It can, three different ways, and the differences are not cosmetic. A browser extension, a web page that computes codes, and a desktop app sit at three very different points on the convenience-versus-compartmentalization line. Here is what each one actually does to your security, with the risks stated plainly.

Three approaches, one algorithm

All three compute the same thing. TOTP — the time-based one-time password standard, RFC 6238 — is local arithmetic: a shared secret plus the current time, hashed into a six-digit code every thirty seconds. Nothing is transmitted, nothing is fetched. Where the approaches differ is where the secret lives, what else that host can see, and who you have to trust.

Approach	What it is	Page access	What persists	Whom you trust
Browser extension	Installs from the Chrome Web Store or Firefox Add-ons, captures QR codes, offers codes as you log in	Yes, by permission	Secrets stored in browser storage	The extension's developer and the store's review
Web-app authenticator	A page that computes codes in your browser tab	None — it is just a page	Only what the page keeps, ideally nothing	The operator of that one URL
Desktop app	Native app with its own encrypted database	None, outside the browser	A local database file	The app's developer, locally

Extensions: maximum power, maximum exposure

The extension is the most convenient form of browser 2FA. The best-known example, the open-source Authenticator extension — authenticator.cc, listed on the Chrome Web Store with builds for Firefox and Edge — captures the enrollment QR code straight off the page, stores the secret, and shows or auto-fills codes when you next visit the login screen. No phone, no retyping, no context switch. As a piece of design, it is excellent.

The risk model is the design. An extension that can read the QR code on a page can, by the same permission, read the page — including the password you type and the code it just filled for you. That power is granted to whoever controls the extension, and control can change. The cautionary tale is The Great Suspender, a tab-sleeping extension with hundreds of thousands of devoted users: development changed hands when it was sold to an unknown third party, version 7.1.8 added an exploit that could run nearly arbitrary code on every install, and Google ultimately delisted it as malware and remotely disabled it in February 2021. Nobody who installed it had done anything wrong. The store's review is a filter, not a guarantee — and an acquisition does not need your consent to inherit your permissions.

Google's Manifest V3 platform, shipped with Chrome 88 and now the baseline for new extensions, narrowed this exposure: background pages became service workers, the blocking web-request API was replaced, and — most relevant here — remotely hosted code is prohibited, so everything an extension runs must ship in the bundle Google reviews, per the official migration guide. That closes the classic loophole of a harmless-looking extension pulling its payload from a server after approval. It does not close ownership changes or malicious updates, because those were never remote-code problems. If you run a TOTP extension, prefer open source with visible history, read the permissions before granting them, and treat a sudden change of developer as a reason to re-evaluate — the extension reviewing your logins should be the least surprising software you own.

Web apps: the math with no permissions

The second approach strips the extension out entirely. A web-app authenticator is a page that does the same local arithmetic RFC 6238 describes: you give it a secret or a QR image, it shows codes, full stop. No install, no store, no permission prompt — because a web page never had page access to anything but itself.

That is a structural difference, not a marketing one. An extension's danger is capability: it can read what you type elsewhere. A web app's danger is identity: the only thing it can betray is what you paste into it, so the whole question is whether you are on the right page. A web authenticator earns trust by making verifiable promises: codes computed entirely in the browser, zero network requests carrying your secret, nothing written to storage, and a reload that clears everything. You do not have to take that on faith — open the browser's DevTools, watch the network tab stay silent while codes appear, or pull the plug on your Wi-Fi and watch the codes keep coming. A page that survives airplane mode is not phoning home.

That is how 2FA by DependsiT works, stated plainly. The guest generator takes a Base32 secret, an otpauth:// URI, a QR code image, or a Google Authenticator export, computes TOTP, HOTP, and Steam Guard codes with per-key algorithm, digits, and period, and does all of it in the page — zero network requests, nothing stored, reload clears everything. Bookmark the URL you verified once. It also installs as a PWA on iPhone, Android, Windows, and Mac, with its own window and icon, working fully offline after first load — at which point it behaves like a desktop app that happened to be delivered by a browser.

The weakness is symmetric with the extension's. If malware owns your machine, it can read a web page as easily as an extension popup. And if you paste your secret into a typo-squatted lookalike, you have handed over the factor with your own hands. The mitigations are boring: bookmark the real URL, type nothing into pages you arrived at from ads, and keep the machine clean. For keeping codes working when connectivity dies entirely, our offline TOTP guide covers the full toolbox.

Desktop apps: out of the browser, into a database

The third approach steps outside the browser process altogether. KeePassXC, the open-source password manager, supports TOTP natively — add the secret to an entry, and the app shows codes with copy-paste, Auto-Type, and an optional browser-integration bridge. The database is a local encrypted file you control, syncable anywhere or nowhere.

KeePassXC's own documentation makes the honest point better than a critic could: storing TOTP secrets in the same database as the password eliminates the two-factor advantage, so for maximum security the codes belong in a separate database you open only when needed. That is compartmentalization as a design principle — the same reasoning that puts TOTP authenticators on Windows through a native app rather than a tab. For a deeper comparison of where codes can live, our 2026 authenticator comparison covers the whole field, browser-based options included.

The honest verdict

The purist position says your second factor should never share a machine with your first. If malware owns the laptop, a browser-based TOTP falls together with the password it was supposed to guard. That is true, and it is the argument for hardware keys: a FIDO2 key does not merely hold a secret — it binds the authentication to the genuine domain, so a phishing page fails even when you happily tap the key on it. Our hardware security key guide covers that ceiling. Nothing browser-based reaches it, because TOTP itself is phishable by design — a real-time relay page can pass your code through while it is still valid, as our catalogue of 2FA bypasses explains.

But rank the realistic threats before you rank the theoretical ones. Credential stuffing, phishing, SIM swaps, and leaked passwords make up the daily attack surface, and a browser-based TOTP stops all four. Local malware that reads both your password manager and your authenticator is rare by comparison, and it defeats most phone-app setups too, since the typical user's email, passwords, and SMS all live on one pocket computer anyway.

So the trade is honest: browser-based TOTP gives up a little compartmentalization and gains enormous convenience — which is another way of saying you will actually enable and use it. A hardware key remains the ceiling for accounts that justify it. Between those poles, choose by failure mode: extensions fail through stores and ownership, web apps through the wrong URL, desktop apps through your own keyfile hygiene.

Frequently asked questions

Is it safe to keep 2FA in the browser?

Reasonably, with eyes open. A browser-based TOTP stops the common attacks — stuffing, phishing of passwords, SIM swaps — and loses only to local malware that reads both factors together, which defeats phone-based setups just as well. Keep the browser and OS updated, prefer open-source extensions with visible history, and treat a change of extension developer as a prompt to re-check what you installed.

What is the best TOTP extension for Chrome?

The open-source Authenticator extension — authenticator.cc, on the Chrome Web Store, Firefox, and Edge — is the established choice: QR capture from the page, optional encrypted storage, and public code. Whichever extension you pick, the checklist is the same: open source, minimal permissions, a developer history you can read, and a user base large enough that a bad update gets noticed quickly.

Can a web page really generate TOTP codes offline?

Yes. RFC 6238 computes the code from the shared secret and the local clock — no server, no network. A web authenticator that keeps its promises works in airplane mode, and that is precisely how you test it: load the page, cut the connection, and watch the codes keep rotating. If the network tab in DevTools stays empty while codes appear, no secret is leaving the page.

What happened with The Great Suspender?

A popular Chrome extension was sold to an unknown third party, and a later update added an exploit that could run arbitrary code on users' machines. Google delisted it as malware in February 2021 and remotely disabled it for every install, leaving users to recover suspended tabs by hand. The lesson for 2FA is about permissions, not one bad actor: the extension holding your secrets inherits its access to your browsing, and that access transfers with ownership.

Web app or desktop app for TOTP?

A desktop app like KeePassXC offers the most separation — a local encrypted database outside the browser, ideally a second database for secrets alone, per its own documentation. A web app offers the least friction and no install, with the one requirement that you verify the URL and its offline behavior once. Both beat SMS. If convenience decides whether 2FA exists at all, the web app is the pragmatic answer.

If that login prompt is still waiting, try it now: open the guest generator, paste a secret, and leave your phone where it is.