What Autothenticator is
Autothenticator is an authenticator for two-factor (2FA) one-time codes, made by Winfrasoft. It does what Google Authenticator or Microsoft Authenticator do (time-based TOTP and counter-based HOTP codes), and it adds three things:
- It fills the code in for you, the way a password manager fills a password.
- It fills only on the site or app each account belongs to. On a lookalike phishing site it fills nothing, and it warns you.
- Fill-only accounts: by default the code is never shown or copied, only filled in. A scammer can't talk the person into reading it out.
It also stores passkeys, and fills one-time codes from text messages on Android.
It isn't a password manager. It holds one-time codes and passkeys, not passwords.
The idea in one line: TOTP made to behave like FIDO. The code only ever reaches the genuine site, and the website doesn't need to change anything.
Supported code types
| Type | Supported |
|---|---|
| TOTP (RFC 6238): codes that change every 30 or 60 seconds | Yes. SHA-1, SHA-256, SHA-512; 6 to 8 digits; any period |
| HOTP (RFC 4226): counter-based codes | Yes. Each code works once, in order |
| Steam Guard, push approvals (Microsoft number matching, Duo Push) | No. These aren't standard OATH codes |
| OCRA challenge-response (bank and VPN tokens) | No |
| Passkeys (WebAuthn / FIDO2) | Yes (see Passkeys in Autothenticator) |
| SMS codes | Filled on Android, never stored (see Codes from text messages on Android) |