The code hops from your phone into the field.
OTPHop fills one-time codes from your Android phone into Chrome, Edge, Brave and Arc. Pair once. Codes are end-to-end encrypted, and only the code leaves your phone.
7-day free trial. Then $9.99 once, for life. No account, no subscription.
Set up once, then forget it
Three steps, about two minutes.
-
Install the app and the extension
Add the extension to your browser. Install the OTPHop app on your Android phone and allow the SMS permission when it asks.
-
Scan the QR code
The extension shows a QR code. Scan it with the app. You do this once for each browser.
-
Click a code field
Click an empty code field on any site. When the text arrives, the extension fills in the code. It never uses a code older than 3 minutes.
Only the code leaves your phone
Your phone sends the code and nothing else. Your phone and your browser share a key that the server never sees. The relay in the middle passes along an encrypted message it cannot read.
What leaves your phone
- The code, encrypted with a key only your phone and your browser hold.
- The relay keeps that encrypted message until your browser confirms it received the code or for 3 minutes, whichever comes first. It logs no content.
- No accounts and no email sign-up.
What never leaves your phone
- The text of your SMS.
- Who sent the SMS.
- Your contacts.
- Your SMS history. The app asks only to receive new SMS, to use the internet and to run in the background. The QR scanner library adds a network check.
Try it for 7 days. Pay once if it works for you.
The trial is the full app. It starts when you first pair a browser and needs no payment details. When it ends, the app stops forwarding codes until you enter a license key.
After you pay, the license key is on Gumroad's receipt. Gumroad also emails it to you.
- No subscription and no renewal
- 7-day free trial before you pay
- One phone, up to 3 browsers
- Move to a new phone when you need to
- Works in Chrome, Edge, Brave and Arc
Gumroad is the merchant of record for every sale. It takes your payment, and its legal entity is Gumroad, Inc., United States. When you buy, you agree to the Gumroad Terms of Service. Our refund policy and delivery policy explain the rest.
Questions
Which browsers and computers work?
Chromium browsers: Chrome, Edge, Brave and Arc, on Mac, Windows and Linux. Firefox and Safari do not work. The phone must run Android. There is no iPhone app.
Does OTPHop read all my text messages?
The app can receive SMS, but it cannot read your SMS history. It looks at each new message only to find a code. It skips a message that has no OTP word, such as code, verify or PIN, and it sends only the code. It never sends the message text, the sender or your contacts.
Can the relay or you read my codes?
No. The phone encrypts the code to a public key that your browser created. Only your browser holds the private key that decrypts it. The relay holds only the encrypted message, for at most 3 minutes. The security page has the details and the limits.
Why is the Android app not on Google Play?
You download it from this site as an APK. The download section shows its SHA-256 hash and the signing certificate fingerprint, so you can check the file before you install it.
What happens when the trial ends?
The app stops forwarding codes. Buy a license, enter the key in the app, and forwarding starts again. Nothing is deleted.
Can I use it on more than one browser or phone?
One license covers one phone and up to 3 browsers. Each browser pairs on its own with its own key. The license can be active on a second phone, so you can switch to a new phone.
The code did not fill. What now?
Click the empty code field again. The extension fills a code only while an empty code field has focus, and only if the code arrived in the last 3 minutes. Check that the phone is online and that the app is not paused. If it still fails, write to support@otphop.com.
How can I trust the app without its source code?
The source code is not public, so trust rests on the design and on checks you can run. The app asks for four permissions. RECEIVE_SMS lets it see each new SMS as it arrives. INTERNET lets it send codes to the relay. REQUEST_IGNORE_BATTERY_OPTIMIZATIONS lets it show the system prompt that allows it to run in the background. ACCESS_NETWORK_STATE comes from Google's QR scanner library and only checks whether the phone is online. It has no camera permission. Codes are end-to-end encrypted with a key the relay never sees. The APK is signed, and its SHA-256 hash and signing certificate fingerprint are in the download section, so you can check that the file is the one we published. The security page lists the full model and its limits.
Download
You need two parts: the extension for your computer and the app for your Android phone.
Browser extension
Android app
- Version
- 1.0.0
- Malware scan
- Scan report
TODO: SHA-256 of the signed APK0E:2F:10:60:02:39:05:EA:A2:37:35:4B:06:67:F7:08:0A:2F:B3:F2:61:38:D3:DE:05:95:A3:85:4D:E7:D7:73# Mac and Linux shasum -a 256 otphop.apk # Windows certutil -hashfile otphop.apk SHA256 # Android SDK build-tools apksigner verify --print-certs otphop.apk
Install on your phone
- Download the APK on your phone, or download it on a computer and copy it over.
- Open the file. When Android asks, allow your browser or file manager to install unknown apps.
- Open OTPHop and allow the SMS permission.
- Install the extension, click its icon and scan the QR code with the app.