TSCR Authenticator
TSCR Authenticator
Powerful Technology. Simple Authentication.
One-time verification codes, Passkeys and supported cross-device sign-in — brought together in a single TSCR module.
We handle the complexity. You enjoy the simplicity. Add your account, select the right sign-in method and approve what matters.
Scan. Import. Autofill. Approve.
Explore Authenticator
1. Authentication made practicalOne product. Different ways to prove it is you.
Online services ask for different kinds of verification. Some want a six-digit code. Others offer a Passkey or ask you to approve a sign-in using another device. TSCR brings these workflows into one familiar place without making you learn the underlying protocols first.
See your code
Open a saved TOTP or HOTP account and use the verification code requested by the website or service.
Use a Passkey
At a compatible service, choose the intended Passkey account and complete the registration or sign-in request.
Less copy & paste
With TSCR Browser Link, use supported website-matched one-time-code and Passkey workflows directly in the browser.
The principle is simple: the right authentication method for the right situation — no unnecessary steps.
Back to contents ↑2. Quick startYou can begin with an ordinary 2FA account. Advanced options are optional.
Launch TSCR, open the Authenticator module and choose to add or import an account.
Scan or import a supported QR code, provide an otpauth:// URI, or enter the service-provided secret manually.
Select the saved account and enter its current code when your service requests it. Where supported, Browser Link can help fill it.
3. TOTP & HOTPTraditional two-factor verification, managed by TSCR.
TOTP — time-based one-time password
After you add an account, TSCR calculates the one-time code from the stored shared secret and the time interval configured by the service. The common setup uses six digits and a 30-second period, but service parameters can vary.
HOTP — HMAC-based one-time password
HOTP uses a shared secret and a moving counter rather than a time window. Codes advance as they are consumed; the authenticator and the service must stay in sync.
What a normal 2FA sign-in looks like
- Enter your username and password on the service website.
- When asked for an authenticator code, find the matching account in TSCR.
- Use the current TOTP code or requested HOTP code.
- Submit it on the site. The website verifies the code.
Practical point: TSCR does not decide whether the website accepts a code. Account secrets, time settings and (for HOTP) counters must match the service.
otpauth:// QR code commonly contains the underlying 2FA shared secret. Treat the image, URI, copied secret and any unencrypted export as sensitive credentials.4. Accounts, QR import & migrationBring existing accounts into TSCR without re-entering everything.
QR / URI / manual entry
Read supported authenticator QR codes, import an image or URI, or enter an issuer, account and secret when a service provides manual setup details.
Keep track of accounts
Review saved accounts, distinguish services and identities, and select the intended entry when multiple accounts use the same provider.
Migration import
Use supported Google Authenticator migration QR workflows to bring compatible OTP accounts into TSCR, then verify a code before retiring the old setup.
Example: move a 2FA account from another authenticator
Use your existing authenticator's supported transfer mechanism, or the service's official 2FA setup page.
Choose the matching QR / URI / migration import path. Review the resulting accounts, names and type.
Successfully verify at least one code with the original service. Keep recovery codes safe and remove the old authenticator only when ready.
otpauth:// setup, Google migration QR, Passkey registration and FIDO HYBRID sign-in are different workflows. TSCR uses the applicable import or authentication path rather than treating all QR codes as interchangeable.5. Passkeys / FIDO2 / WebAuthnA different way to sign in — not another six-digit code.
A Passkey is a public-key credential used by a compatible website or application. Instead of typing an authenticator code, the service issues a cryptographic challenge. TSCR handles the credential-side operation through the supported integration path, using the saved Passkey for the relevant website and account.
| Property | TOTP / HOTP | Passkeys / FIDO2 |
|---|---|---|
| What you use | A temporary numeric code | A cryptographic credential and a sign-in challenge |
| What the service checks | A code generated from a shared secret | A signature verified using the registered public key |
| Typical experience | Read or autofill a requested code | Select an account and approve/verify when required |
| Website requirement | The service must support authenticator codes | The service must support Passkeys / WebAuthn |
Create a Passkey
Begin Passkey registration on a compatible website. Choose the applicable TSCR route, review the account and relying-party details, then complete the confirmation or platform verification required by that route.
Sign in with an existing Passkey
Choose the Passkey option on the website. TSCR selects or presents matching credentials for the site and completes the supported authentication challenge after any required user approval.
6. Choose the right Passkey routeDIRECT first. NATIVE and HYBRID only when appropriate.
DIRECT
Use the TSCR Browser Link extension with the TSCR desktop application on the same computer. The browser request reaches your local TSCR Authenticator; select the Passkey and approve the operation when requested.
- Useful for regular desktop browser sign-in
- No second device or QR/Bluetooth ceremony
- Requires the compatible browser extension and running desktop TSCR
NATIVE + Windows Hello
Windows 11 can use the registered TSCR Windows Passkey provider after it is enabled in Settings → Accounts → Passkeys → Advanced options.
- Windows Hello may request PIN or biometrics
- With that verification, no second TSCR Approve dialog is required
- Provider registration alone does not enable this option
FIDO2 HYBRID
Where supported, choose a cross-device Passkey / security-key sign-in. Scan the FIDO:/ QR prompt with another device running TSCR, then use the required Bluetooth/proximity and approval steps.
- Android TSCR can act as a FIDO2 authenticator in supported sessions
- Useful when the browser and credential device differ
- Requires compatible browser, OS, BLE and permissions
What happens during a DIRECT Passkey request?
7. Browser Link & Secret VaultAuthentication fits into the rest of your TSCR security workflow.
Authenticator where you browse
Browser Link connects a compatible Chrome, Edge or Firefox browser profile to the locally running TSCR application. It can make supported TOTP/HOTP and Passkey actions available in the browser alongside login autofill, payment-card and Secret Generator tools.
- Select the right 2FA account for a website and fill a supported code field.
- Choose the TSCR DIRECT route for a compatible Passkey request.
- Review sensitive requests and approve them in TSCR when required.
- Manage related website credentials separately in Secret Vault.
Secret Vault connection
Credentials and verification, together
Secret Vault handles saved website logins and other protected records. Authenticator handles OTP accounts and Passkeys. Linking related records helps you find the right second factor when signing in, while preserving the distinct functions of each module.
Example: save your email login in Secret Vault, keep its TOTP account in Authenticator, then use Browser Link to fill a supported login and one-time-code field.
8. Real-world sign-in scenariosChoose what matches the service, not the most complicated method.
Personal email with 2FA
Enable authenticator-based 2FA at the email provider. Import the setup QR into TSCR. For later logins, select the matching TOTP account and enter the current code.
Several accounts at one provider
Keep separate Authenticator records for personal and work identities. Check the account name before using the code or selecting a Passkey.
New Passkey on your laptop
At a Passkey-capable website, start registration, choose the compatible TSCR DIRECT/browser path, confirm the intended account and complete the website's registration request.
Windows 11 native sign-in
When the optional provider is registered and enabled, let Windows use TSCR for a compatible Passkey operation and complete Windows Hello PIN/biometric verification as prompted.
Sign in on a computer with your phone
For a supported HYBRID challenge, scan the site's FIDO QR prompt using Android TSCR, complete the Bluetooth/proximity steps and approve the expected request on the phone.
Moving a Passkey to Android TSCR
Where the Android credential-transfer interface is available, use CXF import from a compatible credential manager. Confirm the imported account and rely on site/RP matching for future sign-ins.
9. Backup, export & safe useProtect your ability to recover — not just your next login.
Encrypted Authenticator backup
Use the TSCR Authenticator backup/export workflow for a protected .tscrauth file, and keep a recoverable copy in a secure location.
Import / export options
Supported OTP records can be transferred through TSCR import/export and QR workflows. Plaintext JSON export, where selected, is sensitive and requires careful handling.
Passkeys and device migration
For Passkeys, use supported encrypted TSCR backup/import or compatible system migration mechanisms such as Android CXF where available. Passkey QR export is not supported.
A practical recovery checklist
Before changing devices
- Make a protected backup using the application's supported workflow.
- Confirm you have the correct key, recovery information and access to the destination build.
- Keep service-issued recovery codes independently and securely.
- Test restored accounts before deleting the original setup.
During normal use
- Never share authenticator setup QR images or Passkey private-key material.
- Approve only a sign-in or registration request you initiated.
- Keep devices and browsers updated and protect their local user accounts.
- Remove accidental plaintext exports after a successful protected transfer.
The availability of individual backup, export, migration and Passkey-provider routes may depend on build, operating system and the original credential format. An export/restore path is not proof that an unrelated provider's credential can be transferred.
Back to contents ↑10. Questions & answers
Is TOTP the same thing as a Passkey?
No. TOTP produces a time-based code from a shared secret; Passkeys use public-key authentication through FIDO2/WebAuthn. A service must support the particular method you choose.
Do I need Browser Link to use TOTP/HOTP in TSCR?
No. Authenticator can provide one-time codes directly. Browser Link is an optional browser companion for supported autofill and DIRECT Passkey scenarios, and needs the running TSCR desktop app.
Can I import my existing authenticator accounts?
Yes, through supported QR, otpauth:// URI, manual and Google migration workflows. Compatibility depends on the source format; always verify the imported account against the original service.
Which Passkey method is easiest on the same computer?
TSCR DIRECT through Browser Link is the recommended same-computer workflow where the browser and website are supported. Windows NATIVE and cross-device HYBRID are separate optional routes.
Does Windows 11 NATIVE work immediately after provider registration?
No. The TSCR provider must also be enabled under Windows Settings → Accounts → Passkeys → Advanced options. Windows Hello may request PIN or biometrics. In this route, no additional TSCR Approve dialog is needed after Windows Hello verification.
Can Android TSCR be used as a FIDO2 security key?
In supported HYBRID sessions, yes. The computer/browser shows a FIDO QR challenge and Android TSCR participates through the supported Bluetooth/proximity and approval workflow. This does not imply hardware-backed storage or support on every desktop/browser combination.
Can I import Passkeys from another Android manager?
Where Android's credential-transfer interface is available, TSCR supports CXF import from compatible sources. Website account matching and the original relying-party restrictions still determine whether a credential can be used.
Can I export a Passkey as a QR code?
No. TOTP/HOTP account QR export and Passkey transfer are different operations. Use supported TSCR protected backup/import or compatible system-level transfer paths for Passkeys.
Are all three Passkey routes available on every OS?
No. DIRECT, Windows NATIVE and HYBRID are distinct implementations. The actual options depend on platform, release, browser, permissions, Bluetooth capability and website support.
Verify your identity. Keep your control.
Scan. Import. Autofill. Approve. TSCR securely handles the supported workflow behind each action.
TSCR – Top Secret Chrono Crypt · Authenticator information page · R1, November 2026. Images show referenced v3.0 application/browser screens; features may differ by released build, OS, browser and relying-party implementation.