Privacy policy

Updated November 5, 2026

The TabOTP extension processes your credentials in your browser. We do not collect your login details, verification codes, secret keys or passkeys. We do not sell your data, track your browsing or use advertising or analytics in the extension.

Finding the right account

When you open TabOTP on a website, it uses the exact domain and the username or email you entered to suggest a saved account. When you scan a QR code, the extension reads the visible part of that tab on your device. QR images and files you import are also read on your device. We receive none of these images or files.

Storage and sync

TabOTP saves accounts in your browser profile. If you enable Chrome Sync for extensions, Chrome may sync your time-based (TOTP) and Steam Guard accounts across your devices, including their secret keys and account details. Counter-based (HOTP) accounts and passkeys stay on your device unless you export them.

When you sign in

Choosing Fill enters the selected verification code on the current website. Choosing Copy puts it on your clipboard. When you register a passkey, the site receives a public credential. When you approve a sign-in, it receives a response signed on your device. Your private key stays in the vault during sign-in.

Your choices

You can delete accounts and passkeys in TabOTP.

We use data only for the sign-in features described here. Our use of data follows the Chrome Web Store User Data Policy, including its Limited Use requirements.