TOTP Autofill Demo Pages

Real-world patterns

Each page reflects the attribute shape of a recognizable real-world 2FA flow.

A1 GitHub-style strict baseline

autocomplete="one-time-code" + name="totp". The well-behaved baseline. GitHub, Cloudflare, modern fintech.
Always works (page-load + manual)
A2 Microsoft Office 365 / Entra ID

name="otc", type="tel", autocomplete="off", aria-label="Code". Captured from the public Microsoft 2FA flow.
Manual trigger only — page-load skips (ambiguous signal)
A3 Stripe / Linear / React component

No name attribute; only aria-label="One-time passcode" carries semantic meaning. Typical React-controlled-component shape.
Field invisible to extension
A4 AWS Console MFA

name="mfaCode". Hits the strict vocabulary list. AWS, GCP, similar enterprise IAM challenge steps.
Always works (page-load + manual)
B1 Twitter/X-style named six-box

Six adjacent inputs named code1..code6. All six hit the ambiguous vocabulary via the "code" substring.
Manual trigger only — split-digit rule fires when all six match
B1b Discord-style array notation

Six boxes named otp[0]..otp[5]. React/Vue array-binding convention.
Manual trigger only — same as B1
B2 Slack / Notion-style anonymous six-box

Six boxes with IDs only, no name. State managed in JS, not via form submission. Common React 2FA shape.
All six boxes invisible to current detection
D1 Same-origin iframe carrier

TOTP form embedded in a same-origin <iframe>. Enterprise SSO portals (e.g. Okta-hosted widgets).
Works — content script injects into all frames
E1 SPA modal, no URL change

2FA challenge appears in a modal overlay without any URL change. Notion, Linear, modern SPAs.
Page-load trigger never fires; manual trigger works
F1 TOTP + recovery code coexistence

TOTP and recovery-code inputs on the same page. GitHub-style fallback flow.
Fills TOTP, skips recovery field (exclusion guard)
G1 Shadow DOM web component

TOTP input inside a custom element's open shadow root. Stencil / Lit / Web Component design systems.
Works — deep shadow query finds the input
L1 Late-rendering 2FA field

TOTP input doesn't exist in the initial DOM. Appears after the user clicks "Send code". Banking, telco, government portals.
Page-load doesn't re-fire on mutation; manual trigger works

Synthetic isolation pages

Constructed test fixtures that expose specific detection-logic edge cases. Not representative of any real-world site.

Coming next: Group C (subdomain-switching 2FA flows) and D2 (cross-origin iframe) require a working subdomain with cert and are scoped for a later pass. A future diagnostic page (or in-extension inspector) will let you paste arbitrary HTML and see exactly which detection signals fire.

TOTP autofill demo pages

Real-world patterns

Synthetic isolation pages