Nodkey — KH Labs

Nodkey keeps your passwords, two-step codes and passkeys in one place: Nodkey on your iPhone, behind Face ID. This extension lets Firefox and Chrome use them, and it stores nothing in the browser.

SIGN IN FROM YOUR IPHONE
Click the Nodkey button in a sign-in field. Your iPhone shows the site and a picture of the page, and you approve with Face ID. The extension fills in your user name and password.

TWO-STEP CODES
The same in a code field, also when the page has one box per digit. A code that the site sends by SMS can come from your iPhone too, with a Shortcuts automation.

SIGN IN WITH GOOGLE, APPLE AND OTHERS
Nodkey knows which sites you sign in to with Google, Apple, GitHub, Microsoft or Facebook, and fills that login only on the provider's own sign-in page. At “Check your phone”, the Nodkey button chooses a passkey or a code from Nodkey instead. After you sign in with a provider, the extension can ask to remember it. Your iPhone then gets only the site and the name of the provider.

NEW PASSWORDS GO TO YOUR IPHONE
When you sign up or change a password, the extension offers to save it in Nodkey. The password is locked for your iPhone at once.

PAY WITH A CARD
At checkout, click Pay with Nodkey. Your iPhone shows the shop and the amount, and you approve with Face ID. The extension fills in the card for that amount only, and removes it if the total goes up. This also works when the card fields come from a payment provider such as Stripe: you see the shop from the address bar, and the provider as “via”.

ADD A CARD FOR LATER
On a billing page with no total, the extension can add your card for later payments, without an amount. You turn this on for the browser in Nodkey on your iPhone, and you approve each card with Face ID.

PASSKEYS
When a website asks for a passkey, your iPhone signs. The passkey never leaves it. Passkeys that unlock data (PRF) work too.

PRIVATE BY DESIGN
• Nothing is stored in the browser: no passwords, codes or card numbers
• End-to-end encrypted between the browser and your iPhone; the relay cannot read it
• When you pair, you confirm the same check number on both screens, and each answer from your iPhone is signed
• The relay sees the IP address that the browser connects from and its country, and deletes them with the request after a few minutes
• The extension's keys cannot be copied out of the browser
• Free, no account, no ads, no tracking
• Open source (MIT): github.com/peters/nodkey-browser

You need an iPhone with Nodkey, free on the App Store.