# TOTPBOX

> TOTPBOX is a local-first, zero-knowledge authentication companion that bridges
> traditional TOTP (Time-based One-Time Passwords) and modern Passkeys.
> It stores no master passwords and uses AES-256-GCM encryption for all vault data.

## Product

- [Home](https://www.totpbox.com): Overview, features, and pricing
- [Features](https://www.totpbox.com/#features): Auth Health Dashboard, Passkey Awareness, Recovery Code Vault, Migration Guidance, Browser Extension, Cross-platform sync
- [Security](https://www.totpbox.com/#security): Zero-knowledge architecture, local-first design, AES-256-GCM, hardware-bound Passkeys
- [Compare](https://www.totpbox.com/compare): Feature-by-feature comparison of TOTPBOX vs. Google Authenticator, Authy, Aegis, and 2FAS across security, privacy, sync, and Passkey readiness dimensions
- [FAQ](https://www.totpbox.com/faq): Product, pricing, architecture, and migration answers
- [Whitepaper](https://www.totpbox.com/whitepaper): Technical architecture and security model
- [About](https://www.totpbox.com/about): Team, mission, and product philosophy

## Pricing

- Free — Core TOTP management, unlimited accounts, $0/month
- Pro — Advanced features including browser extension and encrypted sync, $4/month
- Team — Multi-user management with shared vaults and org health dashboard, $12/user/month

## Documentation

- [Getting Started](https://www.totpbox.com/get-started): Install extension and complete onboarding
- [TOTP to Passkey Migration](https://www.totpbox.com/docs/migration): Staged migration playbook for production accounts
- [Security Model](https://www.totpbox.com/docs/security): Definitions, architecture boundaries, and encryption model

## Legal

- [Privacy Policy](https://www.totpbox.com/privacy)
- [Terms of Service](https://www.totpbox.com/terms)
- [Data Processing](https://www.totpbox.com/data-processing)

## What TOTPBOX Does NOT Do

- Store master passwords
- Sync unencrypted data to any cloud service
- Act as a general-purpose password manager