One-time codes inside the profile

Two-factor protection is no longer optional. Marketplaces, ad accounts and social platforms all ask for six digits at sign-in, and they ask often.

With two accounts a phone is fine. With fifty it becomes the slowest part of the day: unlock, find the right entry among fifty that look alike, read the digits, type them before they roll over.

The secret behind those digits already sits next to the account, in a sheet or a note or a shared vault. ARMANOS moves it one step closer, into the profile that signs in with it.

• No second device

  The code appears in the same window where the profile lives.

• No hunting for the right entry

  The key belongs to the profile, so there is nothing to match by name.

• No retyping under time pressure

  Copy the code, or let a flow type it into the form.

• Nothing goes over the network

  The app makes the code out of the key on this computer.

Open the menu on a profile card and pick One-time code. If the profile has no key yet, the window asks for one instead of showing digits.

Paste either form: the bare key a site prints beside its QR code, or the whole otpauth:// line that the code itself contains. From the link the app reads the issuer, the account name, the number of digits, the step and the algorithm, so an unusual site is best pasted as a link.

1. 1

   Open the profile menu

   One-time code sits in the same menu as Fingerprint and Sign-in details.

2. 2

   Paste the key

   JBSWY3DPEHPK3PXP or otpauth://totp/... Spaces, dashes, lower case and = padding are all tolerated.

3. 3

   Save

   A key that cannot produce codes comes back as an error, and nothing lands on disk.

4. 4

   Look at the card

   A 2FA mark appears on the profile, so you see at a glance which accounts no longer need a phone.

It follows RFC 6238 over RFC 4226, the same standard the app on your phone follows. The current time is divided by the step to give a counter, the counter is hashed with your key, and out come the digits the login form is asking for.

The counter goes into eight bytes as two halves, exactly as the standard asks, so a shorter four byte write cannot quietly break it. All six published vectors check out, the furthest at t=20000000000.

Nothing goes anywhere: the key stays in your file and the app does the work itself, so you get a code with the network switched off entirely.

The code sits large in the middle, grouped three and three, because 482 913 is easier to carry across to a form than 482913. The copy button puts it on the clipboard without the space.

A bar under the code drains as the window closes, and the last five seconds are marked so nobody starts typing a code that is about to roll over.

The line above names the issuer and the account read from the link. That is what tells you the code belongs to the account you think it does, when a profile is one of fifty.

The app carries a local HTTP API for programs on the same computer. It is off until you switch it on, it listens on the loopback address only, and every call carries a token except one: the call that asks whether the API is up.

One call names a profile and hands back the current code with the seconds remaining. That is the point of doing this over an API: a script that signs in needs the second factor at the moment the form asks, not thirty seconds earlier.

An AI assistant reaches the same route through the bundled MCP server, under the same token and the same refusals.

On the Flows screen any text field of a step accepts {{profile.totp}}. Put it in an input step aimed at the code field on the login page, and the flow fills it in like the rest of the form.

The variable is a fresh calculation, not a stored value. A code taken at the start of a run would already be stale by the third step, so the profile hands it over at the very moment the flow types it in.

The step log never prints it: where a value came from a variable, four dots stand in its place. The flow clicks into the field, clears it with a shortcut and puts the whole code in with one real input event. If the form waits for key presses letter by letter, put the code in a Type like a person step.

The key lives in profiles.json in the app data folder, next to the rest of the profile. A power cut cannot tear it in half: what you are left with is either the old file whole or the new one whole.

The file carries owner-only permissions, and they travel with it when it is copied into a backup or a synced folder. On Windows they mean nothing, and what protects the file there is your user profile folder, which other accounts do not enter without administrator rights.

You decide where the key travels action by action, not once and for all. A duplicate never takes it, because a copy is meant for a different account.

The app recognises a 2FA column by its name, in English and in Russian alike, so a table you already have usually needs no renaming.

No profile is created until you have seen which column became which field. Rows whose key cannot produce codes are marked before the import, and one checkbox skips them instead of giving you profiles with a broken key.

Restoring a profile export carries the digits, the step and the algorithm along with the key. Reading back only the bare secret would quietly reset an 8-digit or 60-second key, and the account would simply stop letting you in.