Scan MFA QR codes from the current tab or a local image, then keep your one-time passwords in an encrypted vault inside Chrome. Create and restore a user-controlled encrypted offline backup with a separate password. No account, no phone dependency, and no external network requests or user data transmitted.
Free to use · Chrome Manifest V3 · English / 简体中文 / 繁體中文
LukaOTP602 418
175 930
LukaOTP is designed around the real MFA setup flow: import the QR code you are already looking at, keep it locally encrypted, create an offline backup, and get back to signing in.
Choose a strong master password. It never leaves your browser.
Scan the current tab, select a QR image, or enter the secret manually.
Search, click, and paste the code where you need it.
Actual extension UI
Reorder the complete account list, then search, watch the timer, and copy without leaving Chrome.
A focused authenticator that generates codes locally and lets you create or restore an encrypted offline backup, without creating another cloud account.
Secrets are encrypted before they enter Chrome local storage. The LukaOTP Extension makes no external network requests and transmits no user data; it also provides a user-controlled encrypted offline backup and restore flow. The Extension contains no analytics, trackers, or ads.
Import a QR code from the visible tab or a local image. Page capture happens only after your click and is processed in memory.
Search by service or account, see the countdown, and copy a 6- or 8-digit code in one click.
Export an encrypted offline backup with a separate password, choose where to save it, and restore it locally when needed.
Your master password derives an encryption key with Argon2id. Account secrets are protected with authenticated AES-256-GCM encryption and stored locally by Chrome.
The current Chrome release includes user-controlled encrypted offline backup and restore, but remains local-only with no external network requests, account system, cloud recovery, or multi-device Sync. A future Sync phase is planned as an opt-in service with updated disclosures before launch.
LukaOTP is designed around local processing and user control. This summary describes the current release; the complete policy remains the detailed reference.
Read the complete privacy policyThe complete policy covers data types, permissions, retention, deletion, and Chrome Web Store Limited Use.
TOTP generation, encryption, QR recognition, search, and backup import all run locally. The Extension has no analytics, advertising, account system, or cloud sync. This website uses consent-gated analytics separately.
An offline backup is encrypted with a separate password and saved where you choose. The developer never receives or retains the file.
There is no reset service or developer-held copy. Keep service recovery codes separately and protect both your master and backup passwords.
LukaOTP is designed around local processing and user control. This summary describes the current release; the complete policy remains the detailed reference.
Read the complete privacy policyThe complete policy covers data types, permissions, retention, deletion, and Chrome Web Store Limited Use.
TOTP generation, encryption, QR recognition, search, and backup import all run locally. LukaOTP has no analytics, advertising, account system, or cloud sync.
An offline backup is encrypted with a separate password and saved where you choose. The developer never receives or retains the file.
There is no reset service or developer-held copy. Keep service recovery codes separately and protect both your master and backup passwords.
LukaOTP is built for a specific preference: quick desktop access with no cloud service in the loop. Choose the model that matches your threat model.
LukaOTPLOCAL-FIRSTTradeoff: Offline backup is user-controlled and password-dependent; no account system and no cloud recovery.
Good fit when continuity across devices matters most.
Good fit when independent-device isolation matters most.
Good fit when speed and integrated autofill matter most.
Comparison based on public product documentation: 2FAS, Ente Auth, Google Authenticator, Authenticator Extension. Reviewed August 2026.
LukaOTP includes user-controlled encrypted offline backup and restore, but deliberately has no account system or cloud recovery. If you forget your master or backup password, uninstall the extension, or clear its local data before backing up, your vault may be unrecoverable.
Before you begin: keep each service’s recovery codes in a separate safe place. For high-value accounts, prefer passkeys or hardware security keys when available.
No. The developer does not receive or transmit user data. The extension makes no external network requests; account names, possible email usernames, TOTP keys, codes, and one-time tab screenshots are processed locally for the stated features and are not shared.
Only to scan a QR code visible on the tab you explicitly choose. The captured image is processed in memory and is not saved or uploaded.
Yes. LukaOTP runs directly in Chrome and does not require phone pairing. This is convenient, but it means the browser and OTP code are on the same device.
There is no password reset or cloud recovery. An offline backup helps only when you still know its separate backup password. Keep service recovery codes safely stored outside LukaOTP.
The interface supports English, Simplified Chinese, and Traditional Chinese. It generates standards-based RFC 6238 TOTP codes with 6 or 8 digits.
Not in the current local-only release. End-to-end encrypted Sync is on the roadmap and must ship as an opt-in feature with updated privacy disclosures before any network service is enabled.
Yes. The current release is free, with no account and no limit on the number of accounts.
It is published for Google Chrome as a Manifest V3 extension. Other Chromium-based browsers such as Edge and Brave can install it from the Chrome Web Store, but Chrome is the tested target.
Your master password is stretched with Argon2id to derive a key, and account secrets are sealed with AES-256-GCM before Chrome stores them locally. The master password itself is never written to disk.
Only with your consent. No analytics script loads and no analytics request is sent until you opt in, and you can change the choice anytime from the Analytics settings link in the footer. The extension itself has no analytics.
Free to use. No account required.