Codes: the right one first, and when a site rejects it
Which codes come first
At the top of the list are the accounts tied to the site of the current tab, under a label such as For github.com, with a button to show all accounts in their order again. The panel does not guess: an account is tied to a site in one of three ways.
- Added from the site’s page. An account found on a setup page is tied to that site.
- Tied after you copy a code there. When you copy a code on a site the account is not tied to, the panel asks Tie the site; it ties only when you press it. Not now stops asking for that pair while the panel stays open.
- By hand. In the account’s card, Sites takes one host per line, such as
github.com; its subdomains count too.
When the panel knows the site
By default, the panel knows the address of a tab only where you opened OTP.pink — its toolbar button, its context-menu item or your shortcut. On other tabs it shows the list in its usual order.
The setting Codes for the site on any tab changes that. Turning it on asks the browser for the tabs permission;
the browser words it “Read your browsing history” in Chrome and Edge, “Access browser tabs” in Firefox. The browser
could then give the extension the addresses of your tabs; OTP.pink reads only the site of the active tab, sends nothing,
and keeps a site only when you tie it to an account. Turn it off and the panel goes back to the tab where you opened it.
Copy, and the clipboard
One click on a code copies it. The clipboard is cleared 30 seconds later by default — the delay can be 30 seconds to 5 minutes, or never. The browser does not let OTP.pink look at the clipboard, so clearing it also removes anything you copied after the code. Clearing is checked in Chrome; in Edge and Firefox it has not been checked yet.
Finding an account
Search by service, account name or tag. Pin the accounts you use most; put accounts into folders from their cards, and narrow the list to one folder with the chips above it.
A site rejects the code
- Check the computer’s clock. Time-based codes depend on it, and a clock a minute off gives codes the site refuses. The panel warns when the clock is more than a few minutes behind the time an account was added. Fix the system time; if you cannot, the settings have Clock offset, seconds — up to an hour either way.
- Counter-based (HOTP) accounts move on with each Next code: every press uses up a code, whether the site saw it or not.
A row with an error icon
If a row shows an error icon where the countdown ring would be, the extension could not compute a code for that account. Delete the account and add it again with a new key from the site.
How the lock works is on lock and passphrase. The limits of clearing the clipboard, and phishing, are on the security page.