Skip to content
PricingPlans from $15 a month billed yearly: ~20% less than monthly
MetricDeck
Log inStart free

Free and open source · by MetricDeck

Your 2FA codes on your computer, one keystroke away

Tick is a free two-factor authenticator that runs in your browser. Type a few letters, press Enter, and the code is on your clipboard: no more reaching for your phone every time you sign in.

Open Tick, it's freeCode on GitHub
  • No account
  • No server
  • Works offline
  • MIT licensed

How it works

Type. Enter. Paste.

Signing in shouldn't mean finding your phone, unlocking it, opening an app and typing six digits before they change.

  1. Type

    Type to find

    Start typing anywhere and Tick filters your accounts, so the one you want is a letter or two away.

  2. Enter ↵

    Press Enter

    The current code is copied. If it's about to run out, Tick hands you the next one, so it never expires mid-paste.

  3. Paste

    Paste and sign in

    Paste it into the sign-in page. Tick clears the code from your clipboard a few seconds later.

Adding accounts

Bring every account across in a minute

Tick works with any site that offers an authenticator app for two-factor: Google, GitHub, AWS, Stripe, Microsoft, Slack and the rest.

  • Scan the QR code off your screen

    Setting up two-factor on a site? Tick reads the QR code straight from the screen. No phone, no camera.

  • Move from Google Authenticator

    Export from Google Authenticator and scan its transfer code once: every account comes across together. Aegis and 2FAS exports work too.

  • Camera, screenshot or setup key

    Scan with your computer's camera, drop or paste a screenshot, paste an otpauth:// link, or type the setup key.

  • Encrypted backups

    Download an encrypted backup and restore it in any browser with your master password, or move to another app any time.

Security

Your codes never leave your browser

Tick has no server and no account, so there is nothing to breach: there is nowhere your codes are sent.

Encryption
AES-256-GCM with a random 256-bit data key.
Master password
PBKDF2-SHA256 with 600,000 iterations and a random salt wraps the data key. The password is never stored.
Storage
One encrypted record in your browser's IndexedDB. Nothing readable is written to disk.
Network
No server, no analytics, no third-party requests, and a strict Content Security Policy.
Codes
Standard TOTP (RFC 6238), made on your device and tested against the RFC's own test vectors.
Auto-lock and clipboard
Locks after 1 to 60 minutes away, and clears copied codes after 15 to 60 seconds.
The honest trade-off. Two-factor is strongest when your codes live on a different device from your passwords. Keeping both in one browser trades a little of that for a lot of convenience, so use a strong master password and keep your sites' backup codes somewhere safe. There's no password recovery, by design.

Open source

Read every line before you trust it

Tick is MIT licensed. The code that makes the codes, encrypts the vault and reads the imports is small, plain TypeScript with tests against the RFC 4226 and 6238 vectors, and every change is run end to end in a real browser.

Star Tick on GitHubReport a security problem

FAQ

Questions

How do I get my 2FA codes on my computer?
Open Tick in your browser and create a master password. Add each account by scanning the QR code from the site's two-factor setup page, or import them all from your phone's authenticator. Then type a few letters of an account's name and press Enter to copy its code.
Can I move my Google Authenticator codes to my computer?
Yes. In Google Authenticator, choose Transfer accounts, then Export accounts. Tick reads the transfer QR code with your computer's camera or from a photo of it, and imports every account at once. It also imports Aegis and 2FAS exports.
Is it safe to keep 2FA codes in the browser?
Tick encrypts them with AES-256-GCM under a key only your master password unlocks, keeps them in this browser alone and never sends them anywhere. The honest trade-off: two-factor is strongest when codes live on a different device from your passwords. If you use Tick, pick a strong master password and keep your sites' backup codes somewhere safe.
Does Tick send my codes anywhere?
No. There is no server and no account. Codes are worked out on your device from a secret and the time, the encrypted vault stays in your browser, and Tick makes no outside requests and runs no analytics. The code is open on GitHub for anyone to check.
Does it work offline, and can I install it?
Yes to both. Codes need only the secret and the clock, so no connection is needed. Install Tick from your browser's address bar and it opens like any other app. It also corrects for a computer clock that has drifted, the usual reason codes fail.
What if I forget my master password?
It can't be recovered: only you know it, and nothing is stored on a server. Keep an encrypted backup from Tick's settings and your sites' backup codes, so you can get back in if you ever start over.
Is Tick really free? Why does MetricDeck make it?
Yes: free, no account, no limits, MIT licensed, and it stays that way. We built it for ourselves, because reaching for a phone fifty times a week got old. MetricDeck, our paid product, watches marketing numbers and websites for agencies and freelancers.
Can I host Tick myself?
Yes. It's a static site: build it with npm run build and serve the dist folder from any host with HTTPS (needed for the clipboard, camera and screen capture). The repository's README has the steps and the security headers to copy.

Made by the team behind MetricDeck

If you look after websites and marketing for clients, MetricDeck checks every client's Search Console, Analytics, Google Ads and website overnight, and tells you which one needs you today.

Start freeSee the live demo

Free for one client · No card · Read-only access