The short version
- OttoKey is a free tool that fills in your 2FA codes for you.
- Use it for your own accounts, lawfully, and at your own discretion.
- It is provided "as is", with no warranty. The source is MIT-licensed and public.
- You can stop using it anytime by uninstalling.
1. Acceptance
By installing or using the OttoKey browser extension ("OttoKey", "the extension"), you agree to these Terms of Service. If you do not agree, please do not use OttoKey.
2. What OttoKey does
OttoKey is a free browser extension that detects when you are signing in, retrieves the verification (2FA) code from your connected inbox — Gmail or Outlook/Hotmail (up to five at once) — and fills it into the page. It never submits the form for you. Everything runs locally in your browser, with no backend server, no account and no payment. How your mail data is handled is described in our Privacy Policy.
OttoKey can also move the email a code came from to your Trash ("Tidy up inbox"). This is off by default and requires an explicit confirmation before it is switched on. Trashed mail remains recoverable in your account for 30 days.
3. Open source and licence
The OttoKey source code is published at github.com/amogus0471/OttoKey under the MIT licence. You are free to read it, modify it and redistribute it on those terms. The MIT licence covers the code only — the OttoKey name, logo and website content are not licensed for use in a way that suggests your build is the official one.
These Terms govern your use of the official OttoKey extension as distributed on the Chrome Web Store. If you build and run your own copy from source, the MIT licence governs that copy, and the person responsible for it is you.
4. Acceptable use
You agree to use OttoKey only:
- With email accounts that you own or are authorized to access.
- For lawful purposes, and not to access anyone else's accounts.
- Without attempting to misuse, reverse-abuse, or interfere with the extension.
5. Your security responsibility
OttoKey is a convenience tool. Auto-filling a code on the same device you are logging in from reduces the separation that two-factor authentication is designed to provide. You are responsible for deciding which inboxes and which accounts to use it with, and for keeping your device and email accounts secure. If you enable tidy-up, you are also responsible for that choice — the email is moved to Trash, not permanently deleted, and stays recoverable for 30 days.
6. Third-party services
OttoKey relies on the mail APIs of Google (Gmail) and Microsoft (Outlook). Your use of each inbox remains subject to that provider's own terms. OttoKey is not affiliated with, endorsed by, or sponsored by Google or Microsoft.
7. No warranty
OttoKey is provided "as is" and "as available", without warranties of any kind, express or implied. We do not guarantee that it will always detect logins, find every code, or be available without interruption.
8. Limitation of liability
To the maximum extent permitted by law, the developer is not liable for any indirect, incidental, or consequential damages arising from your use of, or inability to use, OttoKey, including missed codes or account lockouts.
9. Changes & termination
These terms may be updated from time to time; the "last updated" date above will change accordingly. You may stop using OttoKey and end this agreement at any time by uninstalling the extension and revoking its access in your Google Account.
10. Contact
Questions about these terms? Email [email protected].