Phone-Free 2FA

Phone-Free 2FA generates time-based login codes in a browser, so users can retrieve TOTP codes at a computer rather than turning to a phone. It creates a new six-digit code every 30 seconds, available to copy from the browser sidebar. It works with services that use standard authenticator codes, including Microsoft 365, but does not receive push-approval requests. Browser installs are listed for Chrome, Edge, Firefox, Brave, and other Chromium browsers. Account details are encrypted and kept locally; the extension says it sends nothing over the network. On Chrome, secret keys use AES-256-GCM encryption with a key derived from the master passphrase using PBKDF2 at 600,000 iterations. Users can export encrypted backups or standard otpauth records. The extension can lock when the sidebar closes or after inactivity, and failed unlock attempts cause longer delays. Touch ID is available on supported Chrome and Edge devices; Firefox users unlock with a master passphrase. There is no central passphrase reset, account recovery, or cross-device sync. The free, open-source extension is made by Phone-Free 2FA, based in Oxford, United Kingdom.

Phone-Free 2FA keeps standard TOTP code generation in the browser and offers local encrypted storage with export options. Users should retain a usable backup, since the extension has no central recovery or synchronization.

It suits people who want TOTP codes while working at a computer, including staff who would rather not keep a phone beside them. It is not suited to teams needing central administration or synchronized accounts.

Phone-Free 2FA is a browser extension for generating standard TOTP login codes on a computer. It best suits people who work at a desktop and want to leave a phone out of the sign-in process. The trade-off is clear: you get private, local control, but you must protect your own passphrase and backups.

Overview

The extension produces a new six-digit code every 30 seconds and places it in the browser sidebar for copying. It supports services that issue standard authenticator codes, including Microsoft 365. It does not process push-approval requests, so it cannot replace an authenticator used primarily to approve prompts.

Account information is encrypted and kept in the browser, and the extension says it sends nothing over the network. That is a strong fit for users who do not want an account backend holding their secrets. It also means there is no central reset, recovery service, or automatic route to another device. Lose the master passphrase and a usable backup, and the extension cannot restore the accounts.

Key features

Local protection

The Chrome Web Store listing describes AES-256-GCM encryption for secret keys, with a key derived from the master passphrase through PBKDF2 at 600,000 iterations. The sidebar can lock when it closes or after a configurable idle period, and repeated failed unlocks cause progressively longer delays. Touch ID unlock is available on supported Chrome and Edge devices; Firefox users use the master passphrase. These controls make a shared or unattended computer less convenient to exploit, but they do not remove the need for a strong passphrase.

Backup and portability

Users can export encrypted backups and standard otpauth records. Encrypted exports are the sensible disaster-recovery option, while otpauth records make migration to another authenticator possible. Because there is no sync, backups must be created and kept somewhere you can reach when the browser or computer is unavailable.

Scope and administration

This is a personal code generator rather than an organization console. It has no tenant, administrator account, central recovery, or administrative view of users' accounts. That keeps the operating model small, but teams that need managed enrollment or oversight should choose a service designed for administration.

Pricing

Free — free. The plan includes the browser extension and TOTP accounts, with no central recovery or synchronization. It is the complete product rather than a trial tier: the pricing model is free, the project is open source, and there is no free trial. For an individual who can maintain backups, the absence of a paid upgrade is straightforward. Users needing managed recovery or multi-device convenience will not find those capabilities in a higher plan.

Platforms

Phone-Free 2FA is offered as an extension for Chrome, Edge, Firefox, Brave, and other Chromium browsers. The broader platform listing includes Android, iOS, macOS, and Windows, but the stated install and usage model is the browser extension. It is therefore most practical on the computer where the browser extension is installed, not as a conventional phone authenticator.

Who it's for

The strongest match is a staff member who signs in from a computer and wants TOTP codes without keeping a phone beside the keyboard. Privacy-conscious individuals who prefer local storage and open-source software will also appreciate the lack of a backend. It is a poor fit for accounts that require push approvals, households that expect automatic cross-device availability, or organizations that need centralized administration and recovery.

Pros and cons

Pros

• Computer-native TOTP: six-digit codes appear in the browser sidebar, which removes the repeated phone lookup during desktop work.
• Local encrypted storage: AES-256-GCM protection and a network-free storage model reduce dependence on a hosted account service.
• Useful migration options: encrypted backups and otpauth exports support both disaster recovery and moving to another authenticator.
• Practical lock controls: inactivity locking, sidebar-close locking, escalating delays, and selected biometric unlocks add meaningful access friction.

Cons

• No recovery or sync: a lost passphrase, device, or backup can leave accounts inaccessible, and there is no automatic second device.
• No push approvals: services that expect approval prompts still require another authenticator method.
• No team controls: administrators get no tenant, user view, enrollment workflow, or centralized recovery.
• Backup responsibility is yours: the privacy benefit of local-only storage comes with ongoing manual maintenance.

Alternatives

For a broader comparison of code-generating tools, see Authenticator apps. The other linked products are primarily distraction blockers rather than direct 2FA substitutes: Freedom, Jomo, Opal, Pluckeye, AppBlock, Focus Bear, Focus Fence, and LeechBlock NG are better considered when your primary problem is limiting apps, sites, or screen time.

Verdict

Choose Phone-Free 2FA if you need standard TOTP codes during computer-based work and are comfortable owning the backup process. Its local encryption, export paths, and focused browser workflow are compelling for an individual privacy-conscious user. Look elsewhere if you require push approvals, automatic multi-device access, central recovery, or team administration.