Security Warning: High Security Risk

Automated analysis found severe security findings in this version. Review the Security Analysis tab before trusting this extension.Extension: Web2FA - Authenticator

HIGH RISK

Web2FA - Authenticator

ID: gmegpkknicehidppoebnmbhndjigpica

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Active

Version

1.5.0

Size

0.30 MB

Rating

3.6/5

Reviews

Users

10,000

Type

Extension

Updated

Feb 22, 2026

Publisher Contextual Analysis

Trusted

Author: hicallmealView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

18,059

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Add 2FA security to your accounts and generate codes in Chrome with Web2FA Authenticator

Tired of taking out your phone when you sign in? Dead Phone? Web2FA lets you easily add 2FA (two factor authentication) security to your accounts without compromising on convenience, all within your browser 📝 How to use: 1. Scan QR codes to add accounts 2. Copy codes when needed 📱 Works just like your phone - Supports all accounts - Twitter, Instagram, Google + more - Import from other authenticator apps 🌐 Accessible anywhere, anytime - Works offline - no sign-in required - Automatically syncs with your Chrome profile 😌 Have peace of mind - Unlimited accounts - Tiny footprint < 1 MB - Back up with ease You can simultaneously add accounts to Web2FA and your phone! It's still recommended you have a phone authenticator (as a backup)

User Growth

Showing data from Feb 18, 2022 to Feb 17, 2023

Versions

No change in user count

Compared to 3 months ago

6 versions released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 4.00 / 5.0+4.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High1

Medium2

Low2

Versions scanned

Showing 1 of 23 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.5.0 Code review	5

Extension Version	Code Review Findings
1.5.0	5

Files with findings

3 distinct paths — top paths by unique finding count:

background.js2
scripts/content_script.js2
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	high	scripts/content_script.js (line 77)	TOTP shared secrets are stored in plaintext in chrome.storage.sync, which is synced unencrypted across the user's Chrome profiles via their Google account. Compromise of the Google account, another extension with the …	1.5.0
2	Privilege Escalation	medium	manifest.json (line 11)	Extension declares <all_urls> host permission and statically injects a content script with TOTP/QR libraries plus a chrome.runtime onMessage listener into every page on the web. The functionality only requires interac…	1.5.0
3	Unauthorized Data Collection	medium	background.js (line 88)	Background service worker invokes chrome.tabs.captureVisibleTab to screenshot whatever site the user is viewing. Combined with <all_urls> host permission and a content script injected on every page, this is a broad sc…	1.5.0
4	Network Interception	low	scripts/content_script.js (line 103)	Content script issues an unrestricted fetch() to a URL passed from the popup (the favIconUrl of the active tab). Because this runs in the page's content-script world with the extension's host permissions, the URL valu…	1.5.0
5	Other	low	background.js (line 60)	On receiving a 'favicon' runtime message, the service worker opens an arbitrary URL from the message payload in a new (background) tab and then injects a message into that tab to extract data. Although the message ori…	1.5.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/2000/svg	http://www.w3.org/2000/svg
www.w3.org	/1999/xlink	http://www.w3.org/1999/xlink
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
github.com	/jiangts/JS-OTP	https://github.com/jiangts/JS-OTP
thewebdev.info	/2021/09/25/how-to-use-the-fetch-api-to-get-an-image-from-a-url/	https://thewebdev.info/2021/09/25/how-to-use-the-fetch-api-to-get-an-image-from-a-url/
github.com	/nuintun/qrcode	https://github.com/nuintun/qrcode
github.com	/nuintun/qrcode	https://github.com/nuintun/qrcode#readme
github.com	/google/closure-library/blob/master/closure/goog/crypt/crypt.js	https://github.com/google/closure-library/blob/master/closure/goog/crypt/crypt.js
www.thonky.com	/qr-code-tutorial/data-masking	https://www.thonky.com/qr-code-tutorial/data-masking
github.com	/zxing/zxing/blob/master/core/src/main/java/com/google/zxing/qrcode/encoder/MaskUtil.java	https://github.com/zxing/zxing/blob/master/core/src/main/java/com/google/zxing/qrcode/encoder/MaskUtil.java

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

3.3 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

The UI should be improved. This extension looks like it was created by a developer from the 90s. But the extension is working very well.

Gobindo Kumer Das·22 May 2026

Very easy to use. It works very well.

Nuno Dias·4 Dec 2025

Been using the older Authenticator app on Chrome for about a decade now, but that project seems to be abandoned. Was hoping this would be a good replacement, but trying to import a QR code image causes all of Chrome to crash, so it's pretty much worthless if they can't even get something as simple as being able to open a file dialog without causing Chrome to crash.

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Warning: High Security Risk

Web2FA - Authenticator

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

Screenshots & Videos

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 23 Versions5

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating