We never receive your data.

Twofold is a free browser extension that generates two-factor authentication (2FA) codes and stores passkeys. It is built so that we never receive any of your data. There are no servers operated by us, no analytics, no advertising and no tracking. This website doesn’t use cookies or analytics either.

What the extension stores

• 2FA accounts (service name, account name, secret key, code settings, linked websites, notes) and passkeys (website, user name, private key).
• Settings (theme, autofill preferences, auto-lock options) and local usage counters used for sorting and for deciding when to show the optional “Rate Twofold” card. These never leave the device.

All of this is stored on your device in the browser’s extension storage. Accounts and passkeys are encrypted with AES-256-GCM. If you set a master password, the encryption key is derived from it (PBKDF2-SHA256, 600,000 iterations) and the unlocked key is kept only in memory.

When data leaves your device

Only when you turn on a sync feature, and only in end-to-end encrypted form:

• Chrome Sync: an encrypted copy of your vault is saved in your browser’s sync storage, which Google syncs to your other browsers signed in to the same account.
• Google Drive: an encrypted copy and encrypted daily snapshots are saved in a hidden, app-specific folder of your Google Drive (drive.appdata scope; the extension cannot see any of your other files).

These copies are encrypted with your master password before upload. Google cannot read them, and neither can we.

Website access

If you enable smart autofill or passkeys, the extension asks for permission to access websites. It uses that access only to detect 2FA code fields and passkey requests on the page you are visiting, and to fill codes or answer passkey requests you approve. Page content is never collected, stored or transmitted.

Clipboard

Codes you copy are placed on your clipboard. If you enable Clear clipboard, the extension clears it after the delay you choose.

Data sharing

We do not sell, share or transfer any data. We don’t have any of it.

Your control

You can export an encrypted backup at any time, turn sync off (optionally deleting the cloud copy), or remove the extension to delete all locally stored data.

Contact

Questions or concerns? See our support page.