Your two-factor codes, typed in from the notch

Crest is a Mac app that keeps your two-factor codes in the notch at the top of your screen. When a site asks for a code in Safari, Chrome, Arc, Brave or Edge, Crest offers it in the notch and types it in for you. Anywhere else, Control-Option-K opens your codes, one press from any app. Your codes stay encrypted behind Touch ID, and they can sync to your other Macs end-to-end encrypted, so we can’t see them. The Authenticator is part of Crest Pro, which you can try free for 7 days with no card. Crest runs on Macs only: there is no iPhone app.

Last updated: October 2026

Written by the developer of Crest on 13 October 2026, the day the Authenticator shipped in Crest 6.5.0. What this page says about Crest comes from that release’s own words and source code. Everything about the other apps was read the same day on the maker’s own page, listed under Sources; we did not install them.

When a site asks, the code is already there

1. Sign in to a site in Safari, Chrome, Arc, Brave or Edge. When the page asks for your code, the notch says the site asks for a code. If your codes are hidden, click Show with Touch ID first.
2. Click Fill in, or press Return while the pointer is on it. Crest types the code into the page one key at a time, and stops if you click into something else. Copy puts it on the clipboard instead, and Not now puts it away.
3. Two accounts on the same site? Crest asks which one you’re signing in with, and remembers your pick for that site.

To know where you are, Crest reads only the address of the page in front, on your Mac, and only while one of those browsers is the front app. Typing the code needs the Accessibility permission, the same one window snapping uses. Without it, Crest says so and offers Copy. Firefox isn’t on the list, so there you open your codes with Control-Option-K and click one to copy it. A counter-based code is never offered on its own, because showing it would use it up; you make the next one when you need it. Control-Option-K is the default, and you can change it in Settings, Keyboard.

Add a site from its QR code, its setup key or a picture

When you turn on two-factor sign-in, the site shows a QR code and, usually, a setup key too. Crest takes any of these:

• The setup key. Copy it from the site and paste it into Type a setup key. Adding a code starts here, because most sites show a key you can copy.
• The QR code on your screen. Leave it open and let Crest look: it checks every window and keeps nothing it sees. macOS asks you once for the Screen Recording permission, as it does before any app can see the screen, and Crest only looks while you’re adding a code. Rather not allow it? Pick the window yourself, and no permission is needed.
• A picture. Drop in a screenshot or a photo of a screen. Crest reads the code and forgets the image.
• A setup link. Paste an otpauth:// link, which is what a QR code holds.

Once a code is in, Crest reminds you that the site asks for one code to finish turning on two-factor. Time-based codes, counter-based codes and Steam’s codes all work.

Moving from Google Authenticator, 2FAS, Aegis or 2Stable

Crest reads what those apps export, so you don’t have to set up each site again:

• Google Authenticator: export your accounts on the phone, then show Crest the QR codes it makes, in a window on your Mac or as a screenshot or photo. A big export comes as several QR codes, and Crest asks for the next one until it has them all. Step by step.
• 2FAS: its .2fas backup file, with or without a password.
• Aegis: a .json export saved without encryption. Crest can’t open an encrypted Aegis file, so export again from Aegis without it.
• 2Stable: its export file.
• Anything else: a text file with one otpauth:// link per line.

Authy and Microsoft Authenticator don’t export codes, so you add those one at a time from each site’s security page. Leaving Authy? Here is how, site by site. After any import, delete the backup file or pictures: anyone who has them can make your codes.

Encrypted behind Touch ID, synced end to end

Your codes are encrypted on your Mac, behind Touch ID. They stay hidden until you unlock them, and then Touch ID keeps them showing until your Mac locks or sleeps; on a Mac without Touch ID, your password does the same. Crest asks again after a lock, sleep or 30 minutes away from your codes.

Click a code to copy it, and it clears from the clipboard after a minute if it’s still there. Copied codes are marked private, so clipboard history, Crest’s own included, and most other clipboard managers skip them, and they don’t travel to your other devices through Universal Clipboard (what clipboard history keeps).

When you set it up, Crest has you save a recovery key. Keep it somewhere safe, away from your Mac: if you lose the key and every Mac that has your codes, nobody can get them back, us included.

Turn on sync and your codes go to your other Macs, end-to-end encrypted: they’re locked on your Mac before they leave it, so we can’t see them. A new Mac gets them when you approve it from a Mac you already use, where the request shows on its notch, or with your recovery key. Our privacy policy lists exactly what the sync server keeps and what it never sees.

If Pro ends, your codes don’t

The Authenticator is part of Crest Pro. If your Pro ends, your codes still work and you can export them; adding or changing codes needs Pro again. Export makes either a Crest backup, locked with a password you choose, or plain setup links, one otpauth:// link per code, that another app can import. A code you delete stays in Recently deleted for 30 days.

Crest or Apple’s Passwords app?

If you have an iPhone, Apple’s Passwords app is the free choice, and for many people it’s enough. It’s built into macOS Sequoia and later and into the iPhone, keeps your codes beside your passwords, syncs through iCloud Keychain, and suggests the code when a site asks. On a Mac, Apple’s guide adds each code by pasting the site’s setup key, and describes no import.

Crest suits a different habit: codes in the notch, typed in when a site asks, opened from any app with one press, imported from Google Authenticator and the others, and kept apart from your passwords. It has no iPhone app. Every option, free and paid, compared.

What it costs

The Authenticator comes with Crest Pro. Sign in inside Crest for 7 days of every Pro feature, no card. After that, Crest Pro, Take and Minutes come together: $24.99 once, on two Macs each, with updates through Crest 7, or $2.99 a month, tax included. Crest’s free tier never expires and needs no account: Now Playing, the Shelf, the Clipboard and window snapping stay free. See the plans, or what else came in this release: Crest 6.5.0.

Sources

Everything about the other apps was read on 13 October 2026 on these pages; none of them was installed or run for this page. Prices change, so check before you buy.

• Crest: version 6.5.0 of 13 October 2026, its release notes, and its own source code and on-screen words, which is where every Crest detail here comes from. What the sync server keeps is in our privacy policy.
• Apple: Use verification codes in Passwords on Mac, About the Passwords app, Show Passwords in the menu bar, Import passwords and the iCloud Passwords extension for Chrome. User reports on Apple’s forum: a Google export QR code refused (September 2024) and the Choose QR code Image button (November 2025).

FAQ

Keep reading: Google Authenticator on a Mac · Best authenticator apps for Mac · Authy Desktop alternatives · Clipboard history on a Mac · Crest overview