AuthPeak — Two-factor codes, encrypted on your device

What it does

AuthPeak replaces the authenticator app on your phone with one that lives in your browser toolbar — private by design, and faster to use.

◎

The right code, first

Open the popup on a website and AuthPeak surfaces the code for that domain at the top, under “Recommended.” Search and favorites are there too.

⧉

One-click copy or fill

Click a code to copy it, or fill it straight into the page’s one-time-code field. Filling only ever happens on your explicit action.

Touch ID unlock

Unlock your vault with Touch ID (WebAuthn PRF) or a passphrase. A one-time recovery code is your backup. It auto-locks after a timeout you choose.

Key features

Everything you need to move off your phone — and nothing that phones home.

★

Search & favorites

Find any account instantly by name, and pin the ones you use most to the top.

⤵

Import from your current app

Bring codes in from Google Authenticator, Microsoft Authenticator, Authy, LastPass Authenticator, and 1Password.

▦

Add codes any way

Scan a QR image, capture a QR that’s on your screen, or paste a secret key. Google Authenticator multi-account exports work too.

⏻

Auto-lock

Your vault locks itself after a period you set, so a walk-up can’t read your codes.

Security & privacy

AuthPeak holds the secret keys behind every one of your logins, so it’s built to keep them on your device and out of everyone else’s hands — including ours.

✓
Local-first & offlineAll data lives in your browser’s local storage on your machine. The extension makes zero network requests and works fully offline.
✓
Encrypted at restYour vault of TOTP secrets is encrypted with AES-GCM. Secrets are never stored in plaintext.
✓
Touch ID or passphraseThe encryption key is protected by envelope encryption and unlocked with Touch ID (WebAuthn PRF) or a passphrase, with a one-time recovery code as backup.
✓
No cloud, no accountsThere’s no sign-in, no server, and no cloud sync of any kind. Nothing to breach because nothing is uploaded.
✓
No data collectionNo analytics, no tracking, no third-party sharing, no ads. The developer has no access to your vault or codes.
✓
No host permissions, no remote codeAuthPeak requests no access to your web pages by default, and ships no remote code — the QR-decoder WASM is bundled in the extension.

Permissions, and why

The extension uses five Chrome API permissions — and no host permissions.

activeTab	Read the current tab’s domain to recommend the right code, and capture the visible tab so you can scan an on-screen QR during import. Temporary, and only because you opened the extension.
scripting	Inject the fill helper into the active tab — only when you explicitly click Fill or drag a code onto a field. It receives just the 6–8 digit code, never your secret or key.
storage	Store the encrypted vault and your settings locally on your device.
clipboardWrite	Copy a code (or your recovery code) to the clipboard when you ask.
alarms	Drive the auto-lock timer.

Your two-factor codes, encrypted on your device — with the right code ready for every site.