Password manager
with built-in 2FA
Fills your password and your 2FA code on any login page. End-to-end encrypted, synced across devices, free to start.
100% local by default · No account required · Open source
See it in action
Your password, then your 2FA code, filled on the page. Everything else about the account one click away.
Everything you need, nothing you don't
Built for developers and teams who take security seriously but hate friction.
Passwords and 2FA, filled together
OTPilot fills your login and then the 2FA code, offers to save new passwords, and suggests strong ones on sign-up forms. No copy-pasting.
End-to-end encrypted sync
Every password, note and 2FA secret is encrypted on your device. The key lives only with you — our servers never see your data.
Secure team sharing
Share collections of passwords with view or edit access, or just a live 2FA code without exposing its secret. Revoke anytime.
Works locally, always
No account needed. Free covers unlimited 2FA codes and 50 passwords or notes, fully offline. Import from your old password manager in a click.
Open source
The extension code is MIT licensed. The cloud backend is source-available. Audit it, trust it.
Auto-detect 2FA setup
OTPilot scans QR codes on setup pages and offers to save the account automatically. No manual entry.
Email codes, filled too
Waiting for a code by email? OTPilot reads it from an open Gmail, Outlook, Yahoo Mail, Proton Mail, Fastmail or Zoho Mail tab and fills it in. Processed only on your device.
Several accounts on one site
Work and personal, staging and production: OTPilot finds every matching account and lets you pick the right one in one click.
Unlock right on the page
Vault locked? Type your master password in the prompt on the page and OTPilot unlocks and fills, without opening the popup.
More than passwords
Secure notes, servers and API keys, with your own fields grouped in sections. Link related items to an account and find everything in one place.
Switch from Google Authenticator
Screenshot its "Transfer accounts" QR codes and select them to import its time-based 2FA codes, decoded on your device. Passwords import from a CSV.
Every device under control
See each connected browser and its sync history, disconnect it or wipe it remotely, and get an email when a new one connects.
Up and running in 60 seconds
No complex setup. No sync accounts to create. Just install and go.
Install the extension
Add OTPilot to Chrome in one click. No account, no setup — works immediately.
Bring your passwords and 2FA
Import from Chrome, 1Password, Bitwarden or LastPass, save logins as you sign in, and let OTPilot catch 2FA QR codes on setup pages.
Log in anywhere, faster
OTPilot fills your password, then the 2FA code when it's asked for. No switching apps, no copy-pasting.
Simple, honest pricing
Start free. Upgrade when you need more.
Free
forever
A complete vault for one browser, stored locally.
- Unlimited 2FA codes
- Up to 50 passwords, notes & other items
- Auto-fill passwords and 2FA codes
- Password generator
- Email code auto-fill
- Import from other password managers
- Master password lock
Personal
per month
Your whole vault, synced across every browser and device.
- Everything in Free
- Unlimited passwords, notes & items
- End-to-end encrypted sync
- Multi-device, multi-browser
- Cloud backup
- Cancel anytime
Team Lite
per workspace / month
Shared passwords and 2FA for small teams and startups.
- Everything in Personal
- 5 seats included
- Shared collections (end-to-end encrypted)
- Share a 2FA code without revealing its secret
- View / edit / manage permissions
- Invite & revoke access instantly
- +$2 / extra seat / month
Paid plans renew automatically and can be cancelled anytime. 14-day refund window for technical issues. Refund policy →
Frequently asked questions
Yes. The extension is fully functional without creating an account: passwords, notes, 2FA codes and auto-fill all work locally in your browser. Cloud sync is an optional paid feature.
No. Every item in your vault is encrypted on your device, each with its own key, protected by your master password. Synced items reach our servers only as ciphertext; the key to read them never leaves your devices. Your master password is never sent anywhere.
Unlimited 2FA codes, plus up to 50 other items (passwords, secure notes, servers, API credentials) on one browser, with auto-fill, the password generator and imports from other password managers. A login that only holds a 2FA code (and its username) never counts toward the 50. Personal removes the limit and syncs everything across your devices.
Personal is $3/month or $30/year; Team Lite is $8/month or $80/year per workspace. Plans renew automatically and you can cancel anytime from the billing page; you keep the plan until the end of the period you paid for. After that your vault stays on your devices, on the free plan: if you have more than 50 items you keep all of them, you just can't add new ones until you're back under the limit or upgrade again.
Yes. Export a CSV from Chrome, Edge, Brave, Firefox, Bitwarden, 1Password, LastPass, Dashlane or KeePass and import it in the extension's Settings. If you already have a site's 2FA code in OTPilot, the imported password is added to that same login. You can also export your whole vault as CSV at any time.
Two ways. Collections share everything (passwords, notes, 2FA) with the teammates you choose, end-to-end encrypted: each member gets the collection key wrapped to their own device key, so our servers never see the content. Members can view, edit or manage a collection. Or share just a live 2FA code: the secret is split in two halves, one on the teammate's device and one on our server, and the teammate only ever sees the current 6-digit code, never the secret.
You lose access to what was shared with you: the team's collections and shared codes. Your own vault is never touched. If you also pay for Personal you go back to it; otherwise you go back to the free plan, keeping all your items.
Yes. The extension is GPL v3 and the backend is AGPL v3 — both OSI-approved open source licenses. You can read, audit, and fork every line. The copyleft terms mean that anyone who distributes a modified version must also keep it open source under the same license.
Yes, within 14 days of a payment (for yearly plans, of the first purchase; renewals are not refunded), if the service didn't work as documented or there was a billing error. We don't offer refunds for "changed my mind", but you can cancel anytime and the free plan lets you try everything first.
OTPilot is available on Chrome and Edge. Firefox and Safari support is coming soon.
Yes. On the free plan you can move your logins and 2FA codes between devices manually with the encrypted backup (export on one browser, import on another). CSV export and import can also move your secure notes. CSV exports include servers and API credentials too, but OTPilot cannot yet import those items back from CSV. Automatic, real-time sync of everything is part of the Personal plan.
Yes. Google Authenticator has a built-in "Transfer accounts" export that generates one or more QR codes. Screenshot them and select the images in OTPilot's Settings — your accounts are imported instantly, no retyping secrets. Everything is decoded locally on your device.