Hey PH! 👋 **How this started** I work across multiple environments. Every day I was hitting 2FA screens, grabbing my phone, squinting at a 6-digit code about to expire, typing it in — and repeating the whole thing 10 times a day. So I built OTPilot: a Chrome extension that auto-fills TOTP codes on configured pages. That solved my problem. The first version worked, but setup required pasting in a base32 secret manually. That's fine if you already know what a TOTP secret is. For anyone else, it was a dealbreaker. **The pivot that changed everything** When a site shows you a QR code during 2FA setup, that QR encodes an `otpauth://` URI with the service name, account, and secret baked in. That URI also exists somewhere in the page DOM — in a hidden input, a data attribute, or an anchor for people who can't scan QR codes. v0.0.3 added automatic detection: OTPilot scans the page for that URI, parses it, and shows a floating prompt: "Save [ServiceName] to OTPilot?" One click. The user never sees a base32 string, never opens the extension popup during setup. That change turned a dev tool into something I'd recommend to my parents. **Where it is today (v0.0.4)** - Automatic 2FA setup detection — works on any site that generates an otpauth:// URI - Zero-click login — detects OTP fields, fills, and submits automatically - Inline unlock — if the extension is locked, a password prompt appears on the page; enter it, press Enter, it unlocks and fills - Wildcard URL patterns — useful for *.staging.example.com setups - MutationObserver fallback — handles SPAs and modals that inject OTP fields dynamically - Encrypted export/import — AES-GCM + PBKDF2, password-protected - Everything local — no accounts, no servers, no telemetry **What's coming** 1. **Firefox support** — next up, using the WebExtensions polyfill so it stays one codebase 2. **Cloud sync** — optional, E2E encrypted; the backend never sees the secrets. One-time payment for personal sync across devices. 3. **Team sharing** — share TOTP codes with teammates without exposing the underlying secret, with instant revocation. Subscription model. The free local-only tier will always exist.

Maker

📌

4mo ago

In my last post, I teased cloud sync. It's here.

OTPilot 1.0.0 is out 🚀

The sync works like this: your accounts are encrypted on your device before they leave it. The server stores an opaque blob that it can't read. If the backend disappears tomorrow, you lose nothing; the local vault stays intact.
Personal plan: one-time payment. Free tier unchanged.
Still on the roadmap: Team code sharing with instant revocation.

3mo ago

OTPilot

Auto-fill 2FA codes on any login page

Auto-fill 2FA codes on any login page