Browser extension
Codes fill in on your computer the moment a site asks, with this phone deciding every time.
Every sign-in code stays on your phone. This computer only gets one when the phone sends it.
Where to get it
-
Chrome
Chrome Web Store
Not published yet
-
Edge
Edge Add-ons
Not published yet
-
Firefox
Firefox Add-ons
Not published yet
-
Safari
Mac App Store
Not published yet
It is not in a browser store yet. It goes up in the Chrome Web Store, in Edge Add-ons, in Firefox Add-ons and, for Safari, in the Mac App Store, once the phone app is out: a computer with no phone to pair to could do nothing with it. This page will carry the four addresses when they exist, and until then it carries no link that pretends to be one.
One extension for Chrome, Edge and Firefox; Safari on a Mac takes the same extension inside a small app of its own. Chrome and Edge from version 133, Firefox from version 128.
How it works
- Fill from AssuredAuth — On a page with a sign-in code field, the chip beside it asks your phone. To send a site's setup QR to your phone, open the AssuredAuth button in the toolbar.
-
Ctrl+Shift+UCommand+Shift+U— Fill a code from your phone on this page. With no code field there, the code appears in a corner of the page with a Copy button. - Add to AssuredAuth — Reads a site's setup QR from this page and sends it to your phone. Nothing is stored here.
- Paired phone — Sign-in codes fill in on this computer when your phone says so.
Pair a computer
Install the AssuredAuth extension in Chrome, Edge, Firefox or Safari, then scan the code it shows.
- Go to Settings › Desktop › Pair a computer
- Point the camera at the code the extension shows
- Codes fill in on your computer when this phone says so.
The code is good for 10 minutes and pairs one phone.
Always allowed — Sites on this list fill in by themselves. Every other site asks on this phone first.
Unpair — Codes will stop filling in on it until it is paired again.
Desktop is part of Premium · Pricing
Security
There is no vault server. AssuredAuth has no accounts, no sign-in and no copy of your vault, so there is nothing of yours on our side to be stolen and cracked. Two things do run server-side, neither of which touches the vault: a relay mailbox for the desktop extension, which stores end-to-end encrypted envelopes (one-time codes, deleted when read; the relay never has a key), and the optional private connection's exit servers, which carry traffic and keep no access logs.
- An X25519 key pair per pairing, private key in the Keychain / Keystore; the relay sees ciphertext only
- Allow on websites — Needed so the chip can appear beside code fields.
It fills a one-time code and the account's username. It is not a password manager, and it holds no vault: the vault stays on the phone.