KeythenticHow it stays private
End to end. Each sign-in makes fresh keys. The code on your screen carries the only way into that session, and it travels from your screen to your phone's camera, never over the network. Everything after that is encrypted with the Noise protocol (X25519, AES-256-GCM, SHA-256) between your phone and that browser tab.
The relay can't read anything. Your phone and computer meet through a small relay on keythentic.com, because they're usually not on the same network. It only ever sees scrambled bytes and a random channel number. Even someone in full control of the relay couldn't read a login or slip in a fake one: the connection would fail and both screens would say it was tampered with. The relay keeps no logs of who connects.
It sees nothing until you ask. Out of the box the extension can't read any website. It gets access to one tab at the moment you click it or press the shortcut, and only there. Showing the key in every sign-in field is an option you turn on, and Chrome asks you before it is allowed.
Nothing stays on the computer. The extension stores no passwords, keys, history or settings. While a request is open it keeps which tab asked, in the browser's memory only. A login you typed and might want to save is held there for two minutes, and a 2FA code for the next page for 90 seconds. All of it is gone when the browser closes.
Made to resist phishing. Chrome tells the extension which site is asking, so a page can't pretend to be another site. Your phone shows that site's real name, and only offers logins saved for it.
Someone photographing your screen gets nothing. Each code works once. If someone else scanned it first, your phone would be turned away, and the check codes wouldn't match. A login you save is only sent after you've confirmed on the computer that the codes match.
What no extension can prevent
Once a password is in a web page, the page can read it, because it has to send it to sign you in. So malware already on the computer, or another extension allowed to read every site, could see it too. That's true of every password manager. Where a site supports passkeys, use them: Chrome's own Use a phone or tablet option works with Keythentic's scan button too, and a passkey never leaves your phone.
Get it
Add Keythentic from the Chrome Web Store. It works in Chrome, Edge and Brave. You'll also need the Keythentic app on your Android phone, version 0.12 or newer.
Questions about how it works? Contact us.