Lube SecurityPrivate beta on macOS

Your 2FA codes, on the Mac you’re using.

Lube Security keeps your two-factor codes in the menu bar, a shortcut away, synced between your Macs and end-to-end encrypted. Passwords stay out of it, on purpose.

Request a Security invite

Lube Security's main window: a list of two-factor codes for Cloudflare, Coinbase, Discord, Docker, Dropbox, Figma, GitHub, Google and npm, each with its current six-digit code, the next code underneath, the seconds left, a favourite star and a notes button. A sidebar groups codes by tag, app and email. — Your codes, the next one underneath, a shortcut away.

Your codes are on your phone and you’re on your computer.

Press ⌃⌥K from any app, type a few letters of the account, and press Return to copy the code.

The Lube Security quick switcher open under its menu bar icon, with a search field and codes for GitHub, Stripe, Google, Cloudflare, Coinbase and Discord, next to the keys Control, Option and K and the words: From any app. Type a few letters, press Return to copy. — The quick switcher, from the menu bar or ⌃⌥K.

The code runs out while you’re typing it.

The next code shows before the current one expires. Copy in the last few seconds and you get the next one.

Rows of two-factor codes in Lube Security for Cloudflare, Coinbase, Discord, Dropbox, Figma, GitHub and Google. Each shows its current six-digit code in large type, the next code underneath and 29 seconds left. — The next code is already underneath, with the seconds left.

Moving from another authenticator sounds like a weekend project.

Import from Google Authenticator, Aegis and 2FAS, or scan a QR code or paste a setup link. Export any time: your codes are yours.

The Add a code dialog in Lube Security: Scan a QR code on screen, Paste a link or image, Import from a file, or Enter a setup key. Imports read Google Authenticator, Aegis, 2FAS and otpauth links. — Scan a QR code on screen, paste a link, or import a file.

You need a backup code and they’re in a drawer somewhere.

Keep each site’s backup codes with its code, with a note if you like. Mark them as used, copy one when you need it, and they sync with the code, end-to-end encrypted.

Notes for GitHub in Lube Security: a note about the recovery email, and backup codes, 7 of 10 left, with used ones struck through, a Used checkbox, copy and delete for each, and a box to add more. — Backup codes and a note, kept with the code they belong to.

You’re sharing your screen and a code is on it.

Lube Security hides itself when you share your screen, and warns you when your Mac’s clock is off and codes would be wrong.

Lube Security's Codes settings with Hide from screen sharing turned on: it keeps the app out of screen sharing, recordings and screenshots, so codes never show up in a call. — On by default. Turn it off when you want a screenshot.

Your Mac isn’t always in front of you.

Coming soon: Lube Security for iPhone and Apple Watch, with the same codes synced from your Mac, end-to-end encrypted. Favourites first, a countdown on every code, and the next one already showing.

Lube Security on an iPhone and two Apple Watches, in demo mode with made-up accounts. The iPhone lists codes for GitHub, Google, AWS, Cloudflare, Dropbox, Fastmail and Figma with the next code and a countdown. One Watch shows GitHub's code with 11 seconds left on a ring around the screen edge; the other has turned green with a tick and Copied after a tap. — The iPhone and Apple Watch apps, coming soon. On the Watch, the ring counts down, and a tap copies the code.

Got an iPhone Duo?

It’s built for that too. Coming soon with the iPhone app: on iPhone Duo, codes get the extra room, with the account, the code and the next one on each card, and your actions in a rail down the side.

Lube Security on iPhone Duo in light and dark: wider code cards for GitHub, Google, AWS and Cloudflare with the account, the code and the next code, and the actions in a rail down the side. — iPhone Duo, in light and dark.

You’d rather the server never saw your codes.

Codes are encrypted on your Mac before they sync, so the server only ever stores ciphertext.

your sign-in codes within reach, with end-to-end encrypted sync

Which codes do you actually use?

Coming soon: Stats shows which codes you copy most, when, from which device, and which ones you haven’t touched in months. Counted on your devices and synced end-to-end encrypted, so we can’t read them.

A design for the coming Stats page in Lube Security: 357 copies in 30 days, 11% of them the next code, 31 of 40 codes copied, 15 copies per working day, and lists of the most copied codes and where the next code was taken most. — A design for Stats, coming soon.

Your password manager has your passwords and your codes.

We keep them apart. Passwords are coming in their own app, so a password and its second factor don’t sit in the same place.

Want your vault on a server that’s only yours?

Private server hosting is available for maximum security. Your codes are already end-to-end encrypted; a private server keeps even the encrypted copies off shared servers. Tell us what you need and we’ll set it up with you.

Ask about private hosting

The rest of it

PasskeysKeep your passkeys and 2FA codes together for sign-in.
Passwords, kept apartComing soon in their own app, so a password and its second factor are never in one place.
Your code, within reachFind a code by name in the menu bar. Return copies it.
End-to-end encrypted syncCodes are encrypted on your device. The server only stores ciphertext.
The next code, earlyCopy in the last few seconds and you get the next code.
Bring your codesImport from Google Authenticator, Aegis and 2FAS.

Coming to Windows, Linux, iPhone and Android

macOSPrivate beta
WindowsComing soon
LinuxComing soon
iOSComing soon
AndroidComing soon

Request a Security invite

Get your codes off your phone and onto your Mac.