authenticator.sh valid
2FA Authenticator
Open-source (MIT) Chrome extension, free to use, that generates TOTP two-factor authentication codes — the same six-digit codes as Google Authenticator — inside the browser. No sign-up. Secret keys, account names and codes never reach our servers: they are stored in the browser, and in the user's own Google account if Chrome Sync is on. 200,000+ users, rated 4.6/5 from 266 reviews on the Chrome Web Store. Current version 1.15.1. Not affiliated with Google.
- Authority
- 50 reach 5 · trust 5 · quality 25 · freshness 15
- Tier
- listed
- llms.txt
- https://www.authenticator.sh/llms.txt
- llms-full.txt
- https://www.authenticator.sh/llms-full.txt
- Sections
- 5
- Links
- 129
- Size
- 13785 bytes
- Popularity rank
- #932292
- Country
- United States Hosting inference
- Hosting country
- United States Hosting inference
- Country evidence
- No published address evidence collected yet
- For agents
- Documentation: developer or product docs worth reading, nothing to call
- First seen
- 2026-10-25T16:44:37.765Z
- Last checked
- 2026-10-25T19:13:10.402Z
- Badge
Their llms.txt
The beginning of the file, from our validated copy saved 2026-10-25T19:13:04.951Z. Cached copy · Source on authenticator.sh
# 2FA Authenticator
> Open-source (MIT) Chrome extension, free to use, that generates TOTP two-factor authentication codes — the same six-digit codes as Google Authenticator — inside the browser. No sign-up. Secret keys, account names and codes never reach our servers: they are stored in the browser, and in the user's own Google account if Chrome Sync is on. 200,000+ users, rated 4.6/5 from 266 reviews on the Chrome Web Store. Current version 1.15.1. Not affiliated with Google.
- Imports Google Authenticator's export QR code (Transfer codes → Export codes) and any standard otpauth:// QR code.
- Can scan a QR code from the screen, so no phone is needed to set up 2FA.
- Optional password protection: AES-256-GCM, PBKDF2 with 600,000 iterations, recovery code.
- Export to a file (plain or encrypted); automatic local backups (last seven kept).
- Manifest V3 with no host permissions and no content scripts; codes can be inserted into the current page on request (right-click or Ctrl+Shift+Y).
- Free plan and Pro (since 1.14.0): installations from before 1.14.0 keep unlimited accounts; new installations may have a limit on how many accounts they hold for free, which Pro (monthly or yearly subscription, or a one-time lifetime purchase, paid through Stripe with Link as merchant of record) removes. The limit only stops adding accounts — existing codes, export, backups, restoring and sync always work. It is checked on the device from the last policy the server signed, so a limit already received also applies offline; until the extension has reached the server once, nothing is limited.
- Once a day the extension checks in with api.authenticator.sh: a random install id (linked to an email address only when that person buys Pro), version, languages, the number of accounts (never which ones), a few settings, whether it already holds its license key, and a closed list of billing events. Never secrets, account names, issuers, codes or sites.
## Product
- [Chrome Web Store listing](https://chromewebstore.google.com/detail/2FA/ebhcbenbgjmaebpgbldimndmfomjmphd): install page, rating and reviews
- [How it works](https://www.authenticator.sh/how-it-works): cryptography, storage, permissions, network egress, the daily billing check-in and license verification, threat model, reproducible build
- [FAQ](https://www.authenticator.sh/faq): common questions, including why codes are rejected, whether it is free, and what the extension sends to our server
- [Pro](https://www.authenticator.sh/pro): what Pro adds, what stays free, managing or cancelling a subscription
- [Source code](https://github.com/authenticator-sh/2fa): MIT licence
- [Security policy](https://www.authenticator.sh/security): vulnerability disclosure
- [Privacy policy](https://www.authenticator.sh/privacy): what the daily check-in sends, purchases, processors, retention, your rights
## Blog
- [All articles](https://www.authenticator.sh/blog)
- [Best authenticator extensions for Chrome (2026)](https://www
…Machine-readable: GET /v1/resolve?q=authenticator.sh · GET /v1/domain/authenticator.sh · this page as Accept: application/json or text/markdown · MCP lookup_domain
Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.
Own or manage this website?
If you own or manage authenticator.sh, you can update its listing and review file health, discovery activity and score history.
Manage this listing — optional
What verification unlocks
See how your site is discovered—and control what agents see.
- See your website in the map
Review your indexed topics, nearby publishers sharing headings, measured listing exposure and map snapshots in a private report for your website.
- Control what agents see
Edit your listing description, tags, public contact details and additional llms.txt paths. Publish your terms for automated access, attribution and pricing.
- Make your profile eligible for search
A valid, listed, unblocked, verified profile can appear in our publisher sitemap and become eligible for search-engine visibility. Search engines decide what to index and rank.
- Appear in our llms-full.txt
Eligible verified publishers are listed by name, with their file links and summaries, in the service overview agents can read.
Free. No account registration, backlink or payment required. Public discovery remains available without verification.
Let your coding agent verify it
If your coding agent is authorized to manage this website, paste these instructions into it.
Claim my listing on Agent Web Map for authenticator.sh:
1. POST https://agentwebmap.com/v1/sites/authenticator.sh/claims and keep claim_id and claim_secret private.
2. Publish the verification line "AgentWebMap verification: <token>" (token from step 1) in https://authenticator.sh/llms.txt, or use the DNS, meta-tag or well-known method the response describes. This only verifies the listing; your website and domain remain yours.
3. POST https://agentwebmap.com/v1/sites/authenticator.sh/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/authenticator.sh).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verifyCorrections or removal requests: contact the directory.