A browser extension that reads passwords and 2FA codes directly from your password manager and injects them into the active form — no tab switch, no copy-paste, no race against the countdown.
3.2k
devs using it
40s
avg saved/login
0
tabs switched
— Live preview
github.com
alex@example.com
github.com · 1Password
4 8 2 1 9 3
TOTP · Autofill ready
"Every 2FA login is a micro-interruption.
You wrote the line of code.
The authenticator app stole the thought."
Password manager fills your credentials. Good. Now the 2FA prompt appears. Your manager is in another tab. You open it. The code expired. You wait.
~45s lostAWS console, MFA required. You alt-tab to Bitwarden. You cmd-tab back. The session timed out. You start over. The deploy was time-sensitive.
~90s lostYou need to merge that PR but GitHub is asking for a confirmation code. You fumble your phone. The authenticator app asks for FaceID. You're late.
Flow destroyedOne-click install from the Chrome Web Store. Pastkey detects which password manager is running and handshakes via its native messaging host. No extra setup, no master password entry.
~30 second setupPastkey scans the active tab's URL, queries your password manager for matching credentials, and shows you a ranked list in its popup. The best match is pre-selected.
Automatic domain matchOne keyboard shortcut fills the username, password, and — if a TOTP field is detected — the current 6-digit code. The countdown ring shows you how many seconds the OTP has left before it rotates.
Password + TOTP in one shotThe only thing you need to remember
Fills username + password + 2FA simultaneously.
Customisable in settings.
Reads the TOTP seed stored in your password manager's OTP field. Generates the code on-device. Injects it before the 30-second window closes. The countdown ring in the popup is live.
Three GitHub logins? Pastkey shows all matching entries ranked by last-used. Pick with arrow keys. No misfire, no accidental personal-account deploy to work infra.
SPAs, iframes, custom web components — Pastkey uses a deep DOM walker to find credential fields even when your manager's autofill quietly gives up.
Credentials travel from your manager to the page via the browser's native messaging protocol. They never touch the clipboard, so they can't be intercepted by a clipboard sniffer.
Open popup, select credential, fill — all without touching the mouse. Designed for the person who lives in the terminal and finds every click a small indignity.
Pastkey is a conduit, not a vault. It holds nothing between sessions. Audit the extension — 847 lines, no external network calls, no telemetry on credentials.
40s
saved per login
“I was losing ~40 seconds every GitHub login to the authenticator dance. Now it's just... done. Merged the PR the same minute.”
Lena K.
Staff Engineer · Stripe
0
extra tabs opened
“We run a zero-trust setup — password manager is mandatory. Pastkey is the only extension that actually plays nice with Bitwarden's native messaging host.”
Raj M.
Platform SRE · Cloudflare
12×
fewer context switches
“The TOTP countdown ring in the popup is the kind of small thing that shows someone thought hard about this. I don't race the clock anymore.”
Sofi D.
Senior Fullstack Dev · Linear
— Why we built this
Flow state is fragile. It takes 23 minutes to recover a deep focus session after an interruption — security researchers have measured this. Password managers solved half the problem. They fill your credentials seamlessly. Then 2FA arrived and broke the seam again.
Pastkey exists because the correct answer to “where is my OTP?” is “already filled.” Not “in another tab.” Not “on your phone.” Not “expired, try again.” We wrote 847 lines of extension code so you can write more of yours.
— Free. Always.
Core autofill — passwords and TOTP — is free, no account required. Works with 1Password, Bitwarden, and KeePassXC out of the box.
Firefox user?
Firefox beta is available on GitHub. We'll email you when it's stable and on the Add-ons store.
Dev Notes
Constantly switching tabs to copy a 30-second OTP is one of the most disruptive micro-friction points in a developer's day. This guide walks through how modern browser extensions intercept TOTP requests and inject them directly into login fields — no clipboard required. Learn the exact setup that eliminates the copy-paste loop for good.
Not all password manager extensions are built with developers in mind — most are designed for casual users and fall short on OTP auto-fill, CLI integration, and multi-account switching. We compare the top five options across speed, 2FA support, and workflow fit for power users. Find out which one actually keeps you in flow.
The average developer logs into 10–20 services per day — and manual 2FA entry chips away minutes that compound into hours lost per month. Beyond the time cost, clipboard-based OTP workflows carry a subtle but real security risk. This post quantifies the productivity drain and lays out the workflow fixes that power users swear by.
SMS-based two-factor authentication is still the default on dozens of platforms, but SIM-swapping attacks have made it a liability for anyone who takes security seriously. TOTP apps offer stronger protection but introduce their own workflow friction — unless you have the right tooling. Here's the definitive breakdown for developers choosing their 2FA stack.
Between GitHub, AWS, Vercel, Cloudflare, npm, and a dozen SaaS tools, developers manage more high-value credentials than almost any other profession. This ultimate guide covers how to combine a password manager with a 2FA auto-fill browser extension to lock down every account without slowing down your workflow. From first install to full automation — everything in one place.