Codes for the active tab
Exact host or *.domain matching; the account you used last on that site goes first.
nimbuscloud.com 482 915
Browser extension • Chrome, Edge, Firefox
Alpha
The right 2FA code, for the site you're on.
Cifra is a zero-knowledge TOTP authenticator that lives in your browser. Open it on a sign-in page and the code for that site is already at the top: one click copies it.
Cifra is in alpha. It works, but features and formats may still change. Keep another way to sign in to your important accounts (backup codes, a second authenticator) while it matures.
Knows where you are
Services are linked to their domains, so the code you need is the first thing you see.
Zero-knowledge
Secrets are encrypted on your device. The server only ever stores ciphertext.
Everywhere you browse
One vault synced across Chrome, Edge and Firefox, and it keeps working offline.
Features
Less hunting for codes, more signing in
Everything you expect from an authenticator app, built around the tab you are looking at.
Add from the page
On a site's 2FA setup page, one click reads the QR code from the visible tab. Or type the secret by hand.
One-click copy
Click a code to copy it. The clipboard is cleared 30 seconds later, only if it still holds that code.
Bring your codes
Import from Google Authenticator, Aegis, 2FAS or otpauth:// lists. Export to an encrypted backup.
Auto-lock
The vault locks after a period of inactivity (15 minutes by default) and when the browser closes.
A well-protected account
Sign-up confirmed by an emailed code, a 24-word recovery key you must prove you saved, optional 2FA with an authenticator app, passkeys or backup codes, and sign-in with Google.
Offline-first
Changes are saved encrypted on the device and uploaded as soon as the server is reachable.
Self-hostable
Use the hosted service or point the extension to your own Cifra server from the sign-in screen.
Security
Your master password never leaves the browser
Every key that can decrypt your secrets is derived on your device. The server stores ciphertext and a hash of an authentication key, nothing it could use to generate a code.
Argon2id
Your master password becomes a master key (64 MiB, 3 passes), on your device.
HKDF-SHA256
Separate keys for signing in and for unwrapping the random vault key.
AES-256-GCM
Each secret is encrypted with the vault key, bound to its item id.
Server
Receives only ciphertext and the auth key, which it hashes again with Argon2id.
What the server stores
- Your email address
- Encrypted secrets and the wrapped vault key
- Service names and linked domains, in clear text so the badge works while locked
- Sessions and a security log for your account
What it never sees
- Your master password or the keys derived from it
- Your TOTP secrets or the codes they generate
- The pages you visit: tab URLs are matched locally
- Analytics, trackers or ads: there are none
Screenshots
Small popup, full vault
The popup shows what you need right now; the options page manages everything else. Click an image to zoom.
Install
One extension, three browsers
Manifest V3 everywhere, no content scripts and no access to the pages you visit.
Chrome
Chrome Web Store
Add to ChromeEdge
Microsoft Edge Add-ons
Coming soonFirefox
Firefox Add-ons (128+)
Coming soonOn Edge you can already install it from the Chrome Web Store (allow extensions from other stores when Edge asks).
Current version 0.2.0 · Web app · Source code (AGPL-3.0)
Stop reaching for your phone Alpha
Your 2FA codes, encrypted with a key only you know, right next to the address bar.