Stop typing 2FA codes on devices you already trust.
The problem: Two-factor auth is great for security, but re-entering a 6-digit code on your personal phone or laptop every time you sign in is tedious. FastFactor fixes that by generating and auto-filling codes in Chrome on the machines you use every day.
What you're looking at
Each row is a site you've saved. FastFactor generates the same 6-digit codes as your phone's authenticator app, refreshes them every 30 seconds, and shows a countdown so you know when the next code is coming.
- Site name: tap to view or edit details (URL and secret).
- 6-digit code: copy from the popup or let the extension fill it on the login page.
- Timer ring: green, orange, then red as the current code expires.
- Add Site: save a new account from the current tab or paste an
otpauth://link.
Settings let you reorder sites and toggle auto-fill. Sign in once and your list follows you across devices via Firebase.
See it in action
Watch the popup and live code refresh as you sign in.
Problem
2FA is good. Typing a 6-digit code on a laptop I already trust is not. I got tired of opening my phone every time I logged into something in the browser.
Solution
FastFactor is a Chrome extension that stores TOTP secrets, generates codes locally, and fills 2FA fields when it finds them. The popup shows live codes with countdown timers. Firebase sync is optional if you want the same site list on another machine.
How It Works
- Scores visible inputs on each page to find likely OTP/TOTP fields (autocomplete, maxlength, placeholder, inputMode).
- Generates 6-digit TOTP codes from saved secrets using standard HMAC-SHA1 math. Processing stays on your device.
- Matches the current tab's domain to a saved site and fills the code when a verification field is detected.
- Optionally syncs site names and secrets to Firebase after sign-in inside the extension (not on this website).
Tech Stack
Challenges
- React and Vue login forms ignore plain
input.valueassignments. I had to use native setter dispatch and input events. - Some login flows use dynamic forms that only enable submit buttons after React processes input, which required retries and careful button detection.
- Generic OTP scoring must avoid false positives on zip codes, search boxes, and card CVV fields.
What I Learned
Building the TOTP part was fine. Owning other people's auth secrets is a different story. If you store and sync secrets, you own encryption, recovery, breach response, and user trust.
Status
I chose not to publicly release FastFactor because I did not want the security responsibility that comes with storing users' authentication secrets. I still use it personally every day. That was a deliberate call, not a failed project. I also would not call it "completely secure" for public use without a much deeper review.
← Back to Projects