TOTPBOX, the authentication companion: Fast 2FA today. Passkeys when they're ready.
TOTPBOX is an authentication companion for your browser. It fills codes where you sign in, keeps secrets encrypted on your device, and tells you when each account can move to a Passkey.
Watch the 36-second tour- AES-256-GCM, encrypted on device
- No passwords, ever
- Open standard (RFC 6238)
The industry is moving to Passkeys. Your tools aren't.
Set up, store, and fill without leaving the browser.
Capture the setup QR, save it locally, and fill the next 2FA prompt in place.
Built for the transition we actually live in.
TOTP is still everywhere. Passkeys are arriving unevenly. TOTPBOX keeps today's codes fast and moves each account forward when it can.
The browser is where 2FA happens
The extension detects setup screens and login prompts in place, so daily authentication is part of the page instead of a detour to your phone.
Auth health at a glance
See which accounts still depend on TOTP, which are ready for Passkeys, and where recovery codes need attention.
Passkey-aware, not Passkey-hype
TOTPBOX does not pretend every site has arrived. It surfaces upgrade opportunities only when support is real.
Local-first by default
Secrets are encrypted on your device first, with a written boundary around what TOTPBOX will and will not store.
A narrow tool is easier to trust.
TOTPBOX is an authentication companion, not an all-in-one vault. Here is the whole boundary.
What TOTPBOX stores
- TOTP secrets, encrypted with AES-256-GCM on your device
- Recovery codes you choose to keep
- Per-account Passkey readiness and health notes
What it never stores
- Account passwords or your master password
- Passkey private keys (the OS and browser hold those)
- Unencrypted secrets on any server
Details in the security documentation and whitepaper.
What is TOTP?
TOTP (Time-based One-Time Password) is a two-factor authentication standard defined in RFC 6238. It generates a temporary 6-digit code every 30 seconds by combining a shared secret key with the current time using HMAC-SHA1. Because your device and the server compute the same code independently, no secret is transmitted during login.
- 30sHMAC Ticker
- Each code is valid for one 30-second window, then cryptographically replaced.
- RFC 6238Open IETF
- Open standard used by Google, GitHub, AWS, and thousands of enterprise services.
- AES-256GCM Enclave
- TOTPBOX encrypts secrets with authenticated GCM before anything touches storage.
TOTP vs Passkey: what's the difference?
Both are forms of two-factor authentication, but they work in fundamentally different ways. The industry is moving from TOTP to Passkeys, which is why TOTPBOX helps with both.
| Capability | TOTP Standard | Passkey (WebAuthn) |
|---|---|---|
| Standard | RFC 6238 (HMAC-SHA1) | FIDO2 / WebAuthn |
| User action | Type a 6-digit code | Biometric or PIN, automatic |
| Phishing resistant | No, codes can be relayed | Yes, bound to the origin domain |
| Secret storage | Shared secret on both sides | Private key never leaves device |
| Adoption (2026) | Universal | Growing, major services only |
| TOTPBOX role | Stores and encrypts secrets | Tells you when to upgrade |
Most services still require TOTP as a fallback even when Passkeys are enabled. Learn more in the FAQ or the app comparison.
Free for daily 2FA. Pay only for encrypted backup.
Free
Everything you need to secure your authentication on one device.
- Local TOTP storage
- Passkey readiness checks
- Unencrypted export and import
Pro
RecommendedBilled monthly. Cancel anytime.
- Everything in Free
- End-to-end encrypted backup
- Auto migration tracking
- Secret vault backup
Manage your subscription from sync settings after checkout.
Team
For organizations managing secure access together.
- Everything in Pro
- Shared vaults and access control
- Org-wide health dashboard