InboxKey - Autofill Verification Codes

About

Stop copy-pasting verification codes.
__________________

InboxKey autofills verification codes from your email inbox, the same way your phone autofills SMS codes.

Open a sign-in page, click “send code,” and stay on the page. When the email arrives, InboxKey finds the code, checks that it matches the site you are on, and fills it into the code field.

I built this because copying codes from email is annoying. Switching tabs, finding the right email, copying six digits, pasting them, then going back to the login page should not be a whole routine.

InboxKey works with email verification codes, one-time passwords, 2FA codes, login codes, and magic links. It supports regular code fields and the split boxes where each digit goes into its own box.

Magic links show up in the popup with the sender and destination domain. They only open after you confirm, so InboxKey does not silently send you to password reset or account recovery links.

SMS codes can also work through Google Messages pairing. This is for Android SMS through Google Messages. iMessage is not supported due to it's design.


How it works
__________________

1- Connect your mailbox.
2- Gmail and other IMAP mailboxes work through InboxBridge, a small free companion app that runs locally on your device.
3- Visit a page that asks for a verification code. Watch the field being auto-filled.


Privacy
__________________

InboxKey needs access to email codes, so privacy is the main point of the project.

Everything runs on your device.

There are no InboxKey servers, no cloud relay, no analytics, no telemetry, and no tracking.

InboxBridge connects directly from your computer to your mail provider over IMAP. It does not send your email through an InboxKey backend.

IMAP credentials are stored in your operating system keychain, not in the browser.

Emails are only read in memory long enough to find the code. Recent codes may appear briefly in the popup, then clear when the browser closes.

The source code is public on GitHub, and the build is reproducible.


Mailboxes
__________________

InboxKey works with Gmail and most IMAP mailboxes, including Outlook, Yahoo Mail, Fastmail, iCloud Mail, Proton Mail through Bridge, self-hosted mail, and others.

You can connect more than one mailbox. Codes from connected accounts appear together in the popup.


Settings
__________________

You can choose how InboxKey behaves:

- Fill and submit
- Fill only
- Copy the code
- Show a notification only
- Use the popup manually

You can also turn InboxKey off for specific sites or URLs. Known banking sites can be auto-disabled for safety.

InboxKey also includes dark mode, keyboard support, accessible labels, visible focus states, and reduced motion support.


Open source
__________________

InboxKey is a solo hobby project.

The source code, privacy policy, and architecture notes are public on GitHub.

License: PolyForm Noncommercial 1.0.0. Free for personal use. Source-available. Not for commercial resale.


Support
__________________

InboxKey is free.

There is a “Buy me a coffee” link in the popup and settings for people who want to support the project. It does not nag, block features, or change how the extension works.