2FA authenticator extensions reviewed: where your TOTP seeds actually live

Your authenticator is the thing that's supposed to save you when your password leaks. Put it in a browser extension and it becomes a file on your disk, sitting next to every other extension you've ever installed and forgotten about.

That's not automatically a disaster. I use a browser authenticator myself. But the question that decides whether one of these is fine or terrible isn't the UI, the icon, or the star rating — it's a single question: where does the seed live, and who else can read it? So I lined up the main options on exactly that.

Quick verdict

• Authenticator (authenticator.cc) — open source, roughly 9 million users per its chrome-stats listing snapshot, permissions that match the job. Fine choice — but only if you turn on the optional passphrase, which most people don't.
• 2FAS Auth — the best architecture of the bunch. The extension holds no secrets at all; your phone does, and it approves each fill. Slower, safer.
• TOTP inside your password manager (Bitwarden, 1Password) — genuinely convenient, and genuinely a trade-off: the vault holding your password now also holds your second factor.
• Anything called "Google Authenticator" or "Microsoft Authenticator" in the Chrome Web Store — neither company publishes one. Every result you see is somebody else's build wearing the logo.
• Any TOTP extension requesting access to all sites — skip it. A code generator has no business reading your banking tab.

What one of these actually stores

TOTP is simpler than people think. When you scan that QR code, the extension isn't storing your codes — it's storing a shared secret, a short base32 string, and it derives the 6 digits from that secret plus the current time. No network call. No server. Just math.

Which means the seed is the second factor. Whoever copies it can mint valid codes forever, offline, from anywhere, and your account will happily accept them. There's no session to revoke, no login alert, nothing to notice. The only fix after a leak is re-enrolling 2FA on every affected account by hand — which is why "my authenticator got read once, months ago" is such an ugly sentence.

So the whole review reduces to storage. Everything else is UI.

Where the seed lives (the part nobody checks)

By default, an extension keeps this stuff in chrome.storage, and Chrome's own documentation is blunt about what that is: the local and sync storage areas should not hold confidential user data because they aren't encrypted. It's a file in your browser profile. Any process running as your user account can read it — no exploit, no privilege escalation, no browser bug required.

That's not theoretical, and infostealers know exactly where to look. Gen Digital researchers documented Torg Grabber, an infostealer that targets data from 850 browser extensions — 728 crypto wallets plus 103 password managers and 2FA tools — and pairs with a companion tool to work around Chrome's App-Bound Encryption, according to BleepingComputer's reporting. I went through how that encryption bypass works in the app-bound encryption piece. The short version: extension storage is a documented, actively farmed target.

This is where Authenticator's optional password matters more than any feature on its store page. Per its own docs, turning on password protection encrypts your secrets on the device — including the backups you push to Drive, OneDrive or Dropbox — so they can't be read without the passphrase. Off by default, buried in Settings, and it's the single setting that decides whether a disk-reading stealer walks away with your 2FA or with a blob it can't use. Turn it on.

Credit where it's due, too: the project is open on GitHub, so those claims are auditable rather than marketing. Its Chrome Web Store listing asks for storage, the ability to script the active tab (that's the QR scan), and host access to the Google/Microsoft/Dropbox backup endpoints. Nothing there is a stretch for what it does.

The clone problem: there is no official Google Authenticator extension

Here's the thing that makes this category unusual: the two most-searched authenticator brands don't ship a browser extension at all. Google Authenticator and Microsoft Authenticator are mobile apps. So every "official-looking" result in the store is, at best, a third party's app with a familiar name.

Attackers noticed a long time ago. Bitdefender documented a fake Microsoft Authenticator extension that sat in the Chrome Web Store for about a month back in 2021. More recently, DomainTools researchers reported a Chrome extension impersonating Google Authenticator that had picked up more than 30,000 installs before being flagged, and which requested access to every site the victim visits — part of the ongoing AiFrame campaign, the extension cluster first identified by LayerX Security in February 2026 and also covered by SC Media. A TOTP generator asking to read and change data on all websites is the loudest possible tell, and 30,000 people installed it anyway.

The most instructive case is smaller. Socket's threat research team analysed an extension called CL Suite, published under the handle @CLMasters, which advertised itself as a Meta Business Suite helper that could also generate 2FA codes. According to Socket, it transmitted TOTP seeds and current one-time codes, Business Manager "People" CSV exports and analytics data to a backend at getauth[.]pro — while its privacy policy told users those 2FA secrets stayed local. Socket researcher Kirill Boychenko described its features as "purpose-built scrapers for high-value Meta surfaces". It had roughly 33 installs and had been listed since March 2025.

Two things stand out. First, the extension did the advertised job — the theft rode along with real functionality. Second, once an attacker holds the seed, removing the extension changes nothing; they keep generating valid codes until you re-enrol. The developer behind CL Suite has not publicly responded to Socket's findings as of 26 August 2026.

Low install counts, by the way, are not comfort. Thirty-three victims with Meta ad-account access is a better payday than thirty thousand random users. I dug into the broader pattern of seed-stealing clusters in the 37M-download campaign write-up.

How I'd score one before installing

No mystique here — this is the same checklist the catalog runs, and you can do it by eye in two minutes:

1. Permissions versus job. Active-tab scripting for QR scanning: reasonable. Host access to a named backup API: reasonable. Access to all sites, webRequest, management: not for a code generator.
2. Is the source public? For a security tool, "trust me" should cost it points. Authenticator and 2FAS both publish theirs.
3. Encryption at rest. Is there a passphrase option, and is it on? If the answer is "there isn't one", your seeds are a readable file.
4. Where do backups go? A local encrypted export is very different from an auto-sync into a cloud account you're permanently logged into.
5. Publisher history. How old is the listing, how many updates, and has ownership changed hands? Extension-ownership handoffs are a well-worn attack path.
6. Does the name borrow a brand? If it uses a big vendor's product name and that vendor doesn't ship an extension, that's your answer.

You can check most of this on an extension's Extenshi catalog page, which lists the declared permissions and scanner findings side by side instead of making you read a manifest.

The alternatives, ranked by how much they trust the browser

2FAS Auth — my architectural favourite. The extension is a courier, not a vault: it asks your paired phone for the code, the phone encrypts and sends it, the extension drops it in the field. Per 2FAS's own explanation, the secrets stay on the device, and each fill needs an approval tap. A stealer that reads your extension storage finds nothing worth having. The cost is friction — your phone must be nearby and awake. Store listing here.

TOTP in your password manager — Bitwarden and 1Password will both hold your codes next to the matching password and autofill both. It's lovely to use. It also means one compromised vault hands over both factors, which is why Bitwarden ships a standalone Authenticator app that deliberately lives outside the password manager. If you go this route, keep your highest-value accounts (email, bank, domain registrar) out of it. Same-vault convenience is a fine default for the other forty logins. I compared the vault extensions themselves in the Bitwarden vs 1Password review, and the deeper cryptographic caveats are in the zero-knowledge study piece.

A phone authenticator, no extension at all — still the boring correct answer for accounts you'd cry about losing.

Passkeys or a hardware key — where a site offers them, they beat every option above, because there's no shared secret to copy in the first place. TOTP is a stopgap we've all been standing on for a decade.

Final recommendation

If you want codes in the browser, use Authenticator with the passphrase switched on, or use 2FAS if you don't mind reaching for your phone. Don't install anything that borrows a Google or Microsoft product name, and don't install any authenticator that wants to read every site you visit — that permission is not a design shortcut, it's the payload.

And do the part everyone skips: your seeds are only as safe as the other extensions in the same browser. One over-permissioned PDF converter with disk-reading malware behind it undoes all of the above.

Check what you've already got installed. Run npx @extenshi/guard scan to see what's in your browsers right now and disable anything you can't justify — guard docs here — or look up a specific extension's permissions and scanner findings in the Extenshi catalog. See security report →

Sources

• chrome.storage — Chrome for Developers
• Malicious Chrome extension steals Meta Business Manager exports and TOTP 2FA seeds — Socket
• The AI Frame campaign continues — DomainTools Investigations
• “AiFrame”- Fake AI Assistant Extensions Targeting 260,000 Chrome Users via injected iframes — LayerX
• "AiFrame" browser attacks continue with fake authenticator, converter extensions — SC Media
• New Torg Grabber infostealer malware targets 728 crypto wallets — BleepingComputer
• Fake Microsoft Authenticator extension discovered in Chrome Store — Bitdefender
• Authenticator — overview docs
• Authenticator — source on GitHub
• Authenticator — Chrome Web Store listing
• Authenticator listing stats — chrome-stats
• How does the 2FAS Auth browser extension work? — 2FAS
• 2FAS Auth — Chrome Web Store listing
• Bitwarden Authenticator app

---

This article is based on publicly available security research and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If any entity referenced here believes information is inaccurate, contact [email protected] and we will review and update.