Digital Habits: Phone-Free 2FA

To add an account:

• In the service's security settings, add a new sign-in method and choose an authenticator app.
• It shows a QR code, which the extension cannot scan: choose Can't scan the QR code? or similar to see the secret key as text, and copy it.
• In Phone-Free 2FA, click Add account, give it a name such as My University, and paste the key.
• Type the code it shows back into the service to finish.

Instructions, under your accounts in the sidebar, walks through this step by step for Microsoft accounts, and in general steps for any institution or service.

Search the web for your institution's own page about it, for example "your institution multi-factor authentication". It says where to add an authenticator app and get the setup key. If the steps do not work, ask your IT service.

When you log in, click I can't use my Microsoft Authenticator app right now, then Use a verification code, and paste a code from Phone-Free 2FA. The extension makes codes only: it cannot approve a push request, where you tap to confirm a sign-in on your phone, and it does not receive text messages.

It encrypts your accounts, and you type it to unlock them. It needs at least 12 characters; a few unrelated words make a strong one. There is no reset. If you forget it, Forgotten your passphrase? on the unlock screen restores your accounts from a backup file; without a backup, they are gone.

It locks when you close the sidebar, and after 5 minutes without use. Change that in Settings › Auto-lock after. For the same reason, a code you copy is cleared from the clipboard after 30 seconds.

In Chrome and Edge, yes: after you unlock, the extension offers Touch ID and sets it up in a new tab. On Windows, choose Google Password Manager or 1Password when asked; Windows Hello does not work for this yet. Firefox does not allow it, so there you use your passphrase.

Accounts do not sync: each browser profile has its own. To copy them:

• Settings › Export backup › Encrypted backup saves a file protected by a password you choose, and a warning in the top bar says when your accounts have changed since.
• On the other computer or browser, install Phone-Free 2FA and open Settings › Import backup with that file. It adds the accounts to the ones already there and skips any it already has.

Yes:

• To leave, press ⋮ on an account › Edit to copy its secret key, or use Export backup › Plain text URIs. That file is not encrypted: anyone who has it can make your codes.
• To come in, Import backup also reads a text file of otpauth:// links exported from another app.

Your secret keys stay in your browser on this computer, encrypted with your passphrase, which is never stored. Nothing is sent, and after 5 wrong passphrases it makes you wait, up to 5 minutes. But someone with both your computer and your passphrase can get your codes, so use a passphrase you use nowhere else.

Codes are worked out from your computer's clock, so a clock that is a minute off gives wrong codes. Turn on setting the time automatically. If the timer next to the code is about to run out, wait for the next one.

The browser deletes the accounts stored in it. Export a backup first, and make sure each service has another way to sign you in.