An authenticator app for your PC

How the codes work

Authenticator codes are time-based one-time passwords (TOTP). When you set one up, the site and your app share a secret. Every 30 seconds by default, each side mixes that secret with the current time and gets the same short code. Nothing travels between them, which is why the codes work offline, and why the PC's clock has to be right.

Octoolo reads the secret the way sites hand it out: base32 text (letters A to Z and digits 2 to 7, in any case, with or without spaces), or a full otpauth://totp link. A link can set the number of digits (6 to 10), the period and the algorithm (SHA-1, SHA-256 or SHA-512), and Octoolo follows it.

If a site rejects codes that look right, your clock has probably drifted. Open Windows' Date and time settings and sync the clock, then try the next code.

What it cannot do

• No QR scanning. Use the site's option to show the key as text, or copy the otpauth link if one is offered.
• Time-based codes only. Counter-based codes (HOTP), which a few older services use, are not supported.
• No sign-in prompts. Some services send an “Is this you?” prompt to their own phone app. Octoolo makes codes; it does not answer those.
• No security keys or passkeys. Octoolo does not store or use them.

Moving codes from another password manager is easier: when its CSV export includes one-time code secrets, as Bitwarden's, 1Password's and Safari's can, the password manager's import brings them along. Codes that live in a phone app usually move by QR code, so for those, add Octoolo as a new authenticator from each site's security page.

Codes and passwords in one place: weigh it up

Two-step sign-in works because a thief needs two things: your password and a code. Keeping both in one vault on one PC still stops the most common attack, someone signing in with a leaked password from another site. It does mean that losing this PC, or the master password, takes both away at once.

So plan for that:

• Keep every site's recovery codes somewhere other than this PC: printed, or with a person you trust.
• For the accounts everything else hangs on, such as your main email and your bank, add a second method too, like a phone authenticator or a security key.
• Never let one device hold your only second factor.
• Save an encrypted backup from Import & export now and then.

The account manager shows which accounts have two-step sign-in and which still lack recovery codes.

Why keep codes on your PC

Most authenticator apps live on phones, which keeps the code apart from the computer you sign in on. That separation is worth something, but so is having codes where you work:

• You sign in on the PC all day, and the phone is in another room or out of battery.
• You do not have a smartphone, or do not want work accounts on it.
• You want a second authenticator, so a lost or broken phone does not lock you out.
• You look after shared accounts, such as a small business's social media, from one desk.

The third reason is the strongest. Added as a second place for your codes, next to a phone, the PC makes your sign-ins sturdier rather than weaker.