Rotor generates your one-time codes in the browser, from seeds encrypted with Argon2id and AES-256-GCM. Two permissions, zero host permissions, and connect-src 'none' — so “no network” is enforced by Chrome, not promised by us.
Everything it does today is free forever · GPL-3.0 · not yet on the Chrome Web Store.
A code is a pure function of your secret and the clock. There is no request behind it — which is why it still works with the network cable pulled out.
permissions — storage and alarms, and no host permissions
network requests the bundle is capable of making
of JavaScript on the popup's first load
Free is not a sampler. It is every feature Rotor has ever shipped. Pro exists to fund a second machine and a sync path — neither of which exists yet, and both of which are labelled with the release they land in.
Google Authenticator exports a batch QR — otpauth-migration:// — and it is broken in Aegis, Ente, 2FAuth and the incumbent extension. Rotor decodes it, including multi-QR batches, with a zero-dependency parser that is being published separately under Apache-2.0 so everyone else can fix theirs too.
Plaintext otpauth://, an encrypted backup file, and a QR sequence that imports straight back into Google Authenticator. No account, no version check, no upsell, no confirmation dance. A test whose name is load-bearing fails the build if that ever stops being true.
Argon2id derives a key from your passphrase, AES-256-GCM encrypts each item with a fresh 12-byte IV. Ciphertext lives in chrome.storage.local; the raw key lives only in chrome.storage.session, which dies with the browser. If Argon2id will not load, the vault refuses to open rather than falling back to something weaker.
Permissions are exactly storage and alarms, and there is no host_permissions key at all. An extension that can read a page, inject a script or see your history has to declare it — Chrome then warns you. Rotor has nothing to declare, so Chrome shows no warning. Compare that screen against any other authenticator before installing either.
The same vault on every browser you use, encrypted before it leaves and unreadable by Google, by us, and by anyone who takes the file. Your Drive, your account, your bytes — there is still no Rotor server in this picture, and there never will be.
Put the code in the field instead of in your clipboard. This one needs a content script, which is a permission Rotor does not have today and will not take quietly — it lands as an opt-in in a major version, with the permission change stated in the release notes.
Everything Rotor shipped in v1.0 is free, forever, for everyone. Not capped, not trial-limited, not account-gated. A paid tier may only ever unlock something that did not exist in v1.0 — which is why this list can be printed and held against us.
Nothing on this page asks to be taken on faith. Each row is a mechanism you can run yourself, today, before installing anything.
| Claim | How you check it |
|---|---|
| No network request of any kind | connect-src 'none' in the manifest CSP, plus a build step that greps the built bundle for http(s)://, eval(, new Function( and non-literal import() — check-no-remote-code.mjs |
| Two permissions, zero host permissions | Read manifest.config.ts. Or install it and look at the blank dialog. CI fails on any change to the permission set — manifest.config.ts |
| Export is never gated | An end-to-end test drives a real Chromium and asserts export is reachable in two clicks from a fresh profile with no account — export-is-never-gated.spec.ts |
| The published package is the public source | The source commit SHA and the SHA-256 of the payload inside the published CRX are both published, with a script that diffs the store copy against your own build — RELEASES.md |
| Free forever, no telemetry | A file in version control, so weakening it is a public diff with a name and a date on it — GUARANTEES.md |
| Who owns it, and what happens if that changes | No sale to an undisclosed buyer, and at least 30 days of public notice naming any successor — OWNERSHIP.md |
One claim we deliberately do not make: reproducible builds. Google re-signs every extension on upload, so a store artifact is never bit-identical to a local build. We claim the narrower, true thing — the ZIP payload inside the published package is byte-identical to a build from the tagged commit.
Prices below are read straight out of the extension's licensing catalog, so this page and the running product cannot disagree. Two of the three tiers are published but not yet on sale — the price is here so you can judge it, not so you can be charged for it.
The whole authenticator. Forever, for everyone.
No account. No card. Not a trial.
Install freeThe same vault, on every browser you use.
or $2.49/month · $39 once, for good
Not on sale yetShared TOTP for a crew, without a shared password manager.
or $3/month per seat
Not on sale yetNo card, no account, no network call to start it. Every Pro capability is live for the whole 14 days — a crippled demo tells you nothing about whether you want the real thing.
When it ends, nothing breaks and nothing is removed. The extension returns to Free, which is still the entire v1.0 product.
Email support@dfacto.ai within 30 days of purchase and you get your money back. No justification required, no phone call, no retention flow.
The trial takes no payment details, so there is nothing to cancel and nothing to refund on it.
A licence covers the whole 1.x line — every 1.y.z release, including the ones that add Drive sync and multi-device pairing.
A future 2.0 is a separate purchase, at 50% off if you already hold a licence, and free if you bought within six months of that release. Handled by the licence portal, never by a check inside the extension.
Prices in USD. Local currency and tax are applied at checkout by our merchant of record, when checkout opens. Nothing here can be purchased today.
Rotor is not on the Chrome Web Store yet. Until it is, the only install route is building from source — which is also the strongest answer there is to “how do I know the bundle matches the code”.
git clone https://github.com/deepakmarathe/authenticator.git && cd authenticatornpm ci && npm run buildnpm run checkThen open chrome://extensions, turn on Developer mode, click Load unpacked, and select dist/.
Both packages come out of the same compiled bundle as the Chrome one and pass the same no-remote-code and package-size checks. The Firefox build additionally passes addons-linter, which is the exact validator addons.mozilla.org runs, with zero errors. Neither has been opened by a person in the browser it targets. If you try one, expect to be the first.
npm run build:firefoxnpm run build:safariFirefox: open about:debugging, This Firefox, Load Temporary Add-on, and pick dist-firefox/manifest.json. Firefox 140 or newer. Safari needs an Xcode step — the repo’s docs/ops/safari.md has it, including one unresolved question about whether Safari honours a module background script.
Requires Node 22+. The build runs tsc --noEmit, the lint bans, the unit tests, a hard byte budget, and the no-remote-code grep — all of it locally, all of it the same set CI would run. Read the source · GPL-3.0-or-later
Nothing that exists. Every feature Rotor shipped in v1.0 is free, forever, for everyone — unlimited accounts, every import format, every export format, encryption at rest, auto-lock, the recovery key, security fixes. Free is not a trial and it is not capped. Pro can only ever gate a capability that did not exist in v1.0, and that is enforced by the type system rather than by good intentions: the list of gateable capabilities is a closed union that cannot name a v1.0 feature.
Partly you should not, and that is the most useful thing on this page. Seeds in a browser are a real security downgrade compared with a hardware key or a phone you can put in a drawer. What Rotor defends against is credential stuffing from an unrelated breach — someone has your password from another site's leak and cannot get in without the second factor. That is the attack that actually happens, at enormous volume. It does not defend against phishing, or against an infostealer already running on your machine. Use passkeys where a site offers them.
The incumbent has around nine million users, sits at 3.7 stars, and has had no Chrome release since 27 August 2024. Its own documentation warns that reinstalling can destroy your data. Rotor is maintained, its source is public, its permission set is two entries wide, and it can import what you already have — including Google Authenticator's batch QR, which nothing else reads correctly.
In two clicks, in three formats, with no account and no network: a plaintext otpauth:// list, an encrypted backup file, and a QR sequence that goes straight back into Google Authenticator. Steam accounts are excluded from the Google QR export by name, with the reason shown, because that format has no Steam type and silently downgrading one would produce codes that do not work.
14 days of Pro, no card and no account. When it ends nothing breaks and nothing is removed — the extension returns to Free, which is the entire v1.0 product. There is no nag, no countdown banner, and no feature that stops working.
No. Pro is priced here so you can see what it will cost and decide whether the deal is fair, but checkout is not open and nothing on that tier ships before v1.2. Taking money for software that does not exist yet is not a launch strategy we are interested in.
GPL-3.0-or-later, with DCO sign-off and no CLA — ever. That combination is deliberate. Copyright stays distributed across contributors, so no single party, the maintainer included, can relicense this as closed source later. The documented failure mode in this category is not that someone copied the code; it is a familiar-looking authenticator quietly gaining trackers after a silent change of ownership.
30 days, no questions asked, once there is anything to refund. Email support@dfacto.ai.