Skip to content

Account protection

Why does an authenticator extension ask for site access?

Page scanning and code filling need permission to work with a website. Here is how to choose the sites an extension can access.

By Authenticator CloudPublished 2 min read
Original editorial illustration: Why does a browser authenticator request website access?
The short answer

An extension needs site access to read a setup QR on a page or fill a code into a form. Grant access to the sites you use, or choose broader access where the browser allows it. You can adjust those permissions later.

In this article
  1. Why scanning and filling need site access
  2. Allow selected sites or all websites?
  3. Set up access for websites you use
  4. Remove extensions and permissions you no longer use

Why scanning and filling need site access

A warning about reading and changing website data describes a broader capability than simply showing a code inside an extension. It is not just an irrelevant installation step.

Mozilla distinguishes site access, clipboard and download permissions, among others. Compare requested capabilities and privacy disclosures with the functions you plan to use.

Allow selected sites or all websites?

Selected-site access narrows scope but can require fresh approval when scanning or filling somewhere new. Broad access is more convenient while expanding where the extension can operate.

Browser-internal pages, stores and other restricted content can remain inaccessible even with broad site permission. A failed fill is not automatically a reason to grant every possible permission.

Set up access for websites you use

In Authenticator Cloud, choose the matching account on the login page you opened, then copy or fill its code. Allow site access when prompted so later logins at that website are easier.

In Safari, check both the extension switch and website access. Desktop and mobile settings are in different places, so use the Safari settings for your device.

Remove extensions and permissions you no longer use

Disable or remove unused extensions and separately manage any cloud data. Uninstalling a local extension is not account deletion or subscription cancellation.

  • Install through trusted official distribution channels.
  • Review the current site's access, not just the main switch.
  • Do not test unfamiliar extensions with real credentials.
  • Follow organizational rules in work browsers.

References

See the official guides above for detailed setup instructions.

Download the app

Apple App StoreiPhone / iPad Open Android APKDirect download · ARM64 only Download