Local Authenticator: Private TOTP Vault Chrome extension security report

Local Authenticator is a private two-factor authentication code generator for your browser. It stores TOTP accounts in an encrypted local vault and generates 2FA codes directly inside the extension popup. Your secrets stay on your device. The extension does not use content scripts, does not request host permissions, and does not connect to websites. Features: - Generate TOTP 2FA codes from a private local vault - Add accounts manually or from otpauth:// setup URLs - Import Google Authenticator export QR codes from image upload or camera scan - Encrypt saved secrets at rest - Unlock with your vault password - Optional biometric/passkey unlock on supported devices - Copy current codes quickly - Search, edit, and delete saved accounts - Works locally without sending your TOTP secrets to a server Security and privacy: - TOTP secrets are encrypted before storage - Your vault password is not stored - Decrypted secrets only live while the vault is unlocked - The extension only requests the storage permission - No host permissions - No content scripts - No external website messaging surface - QR imports and code generation are processed locally in your browser Local Authenticator is designed for users who want a simple, private alternative to cloud-synced authenticator apps.