Updated November 12, 2026

Your secrets stay on your key.

Keycode for Safari is an independent macOS application developed by Vitalys ROUGETET. It requests TOTP codes from your YubiKey and fills them on HTTPS origins you explicitly associate.

Data processed on your Mac

The extension stores website origins, key and account identifiers, account labels, and your pause/exclusion choices in local Safari extension storage. These identifiers are not TOTP secrets. The application does not synchronize this data.

TOTP secrets remain on the YubiKey. Keycode asks the key to calculate a temporary code; it does not read or export the underlying secrets.

OATH passwords and temporary codes

By default, a manually entered OATH password is kept in memory for at most fifteen minutes, never in Safari preferences or website content. Optional “Mémoriser dans le Trousseau de ce Mac” storage is off by default and saves one protected entry per key in the macOS Keychain, without iCloud synchronization.

Reuse requires an explicit unlock click followed by Touch ID or macOS authentication. A local index stores only identifiers of keys with saved passwords so Keycode can offer the unlock action without opening protected Keychain items during a status check. The retrieved secret stays in native process memory; JavaScript receives only an opaque temporary session token. Expiration or termination of the native process requires a new unlock. Keychain entries belong to the macOS account and may be used from its Safari profiles; website associations remain in extension storage.

Codes exist temporarily in memory while used. They are passed to the selected field of the linked HTTPS website, or displayed in the popup for manual entry. The display is cleared on expiration or a context change. No code history is stored. A website receives the code once it is filled, as it would with manual entry.

Safari permissions

HTTPS access is used to detect verification fields and fill an account explicitly associated with the exact origin, including its port. Safari lets you limit permitted websites. Keycode does not fill HTTP pages, embedded frames, inactive pages or private browsing pages, and does not submit forms.

No developer analytics

The application has no account server, advertising, analytics SDK, tracking or automatic error reporting. It does not send browsing data, passwords or codes to the developer. Apple handles purchases and distribution under its own policies.

Contact and beta requests

If you choose to email us for support or beta access, information you voluntarily include is received by email and used to answer your request or organize tests. Never include a password, TOTP secret or code. The website has no data-collection form or analytics integration.

Removing your data

Remove an association or ignored site in extension settings. “Verrouiller maintenant” invalidates unlock sessions and removes the passwords held in extension memory. “Supprimer du Trousseau” removes the selected saved Keychain entry; uninstalling does not guarantee its automatic removal. Safari manages extension data by profile. Disabling the extension does not remove any account from your YubiKey.

Compatibility

This version supports Mac with an OATH-compatible USB YubiKey and CCID enabled. It does not support iPhone/iPad, HOTP, Steam codes or FIDO-only Security Key devices. Keycode is independent of Yubico; YubiKey is a trademark of Yubico AB.

Support: vitalys@rougetet.com.