Web authenticator: TOTP codes in your browser
Published 29 August 2026, updated 19 September 2026.
Most 2FA lives on a phone, which is exactly the problem when you are at your desk, your phone is charging in another room, and a login prompt is waiting. KeyNesta's web app is a full authenticator in the browser: add accounts, scan or upload QR codes, generate TOTP codes, import, back up, sync. Nothing to install, works on any OS.
How a vault in the browser stays private
- Your vault is stored encrypted at rest (AES-256-GCM) in your browser's storage.
- The master key is unwrapped from your passphrase (via scrypt) and held only in memory while unlocked; locking discards it.
- Codes are computed locally. Generating them requires no network at all.
- Auto-lock re-seals the vault after inactivity; a locked vault is just ciphertext.
The complete design, including its known limits, is documented in the security architecture.
When the web app is the right tool
- Desk-bound logins: approve 2FA prompts without touching your phone.
- No smartphone, or a shared family device: a browser is all that is required.
- Lost or dead phone: with sync or a backup file, your codes are reachable from any machine you trust, which turns a bad week into a bad hour.
- Trying before installing: the web app is the full product, free, no sign-up.
A lot of people arrive here from Authy, whose desktop apps were retired in 2024; a browser is the closest replacement there is. The options are compared in an Authy desktop alternative, and for the tokens still stuck in Authy, how to export Authy codes in 2026.
The caveat
Browser storage is only as durable as your browser profile: clearing site data clears the local vault. Treat the web vault the way you would treat any single device: keep an encrypted backup or sync enabled, and losing a browser costs you nothing.
Frequently asked questions
Is a browser-based authenticator safe?
KeyNesta stores your vault encrypted with AES-256-GCM; the decryption key is derived from your passphrase and lives only in memory while the vault is unlocked. A locked vault is ciphertext, even to someone with access to the machine. As with any authenticator, a fully compromised device is a risk no app can remove.
Do I need an account to use it?
No. Open app.keynesta.com, create a vault with a passphrase, and start adding codes. A sync account (just an email address) is only needed if you enable sync between devices.
What happens if I clear my browser data?
The local vault is deleted with it. That is why KeyNesta keeps encrypted backup files and optional sync one tap away. With either in place, restoring takes a minute.
Can I use it alongside the phone app?
Yes. Enable zero-knowledge sync and the same vault is available in your browser and on your phone, kept consistent automatically. The phone apps are coming to the stores; the web app is available today.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms