Sign in without checking your phone or inbox.
Download for Mac · codecatch.app · Privacy · Changelog
CodeCatch is a Mac menu bar app. When a 2FA verification code or sign-in link arrives in Messages or your mail, it copies it. Press ⌘V and you're in, in any browser or app.
- Copies new codes. The code is on your clipboard when it arrives and is cleared after 90 seconds.
- Shows a small banner that never takes focus from what you're typing.
- Keeps recent codes in the menu bar. Click one to copy it.
- Handles sign-in and password reset links. It warns you when a link leads to a different site than the sender's, and never opens one by itself.
- Reads Messages and mail: iMessage, forwarded SMS, the Mail app, Gmail, Outlook and any IMAP account.
- Shows your Bitwarden codes next to the ones you receive.
- Lets your agents sign in, with your OK (off by default).
- Can type the code for you (off by default).
- Works from the keyboard. ⌃⌥⌘C copies the latest code. ⌃⌥⌘F opens search.
- Reads about 35 languages.
- Stays private. Hidden from screen sharing, with optional blur and clearing when the Mac locks.
You need macOS 15 or later on Apple silicon or Intel, and a Mac login password.
Download CodeCatch.dmg. It is
signed, notarized and updates itself. To build from source, run
scripts/install.sh. You only need Apple's Command Line Tools.
For SMS codes, turn on Text Message Forwarding on your iPhone.
To check it works, open the menu → gear → Show Test Code.
| Permission | Why |
|---|---|
| Full Disk Access | To read Messages and Apple Mail |
| Accessibility | Only to type codes for you |
- Apple Mail: Settings → Sources → turn on Apple Mail. No sign-in needed.
- Gmail, Outlook and IMAP: Settings → Sources → Add Account…. Gmail takes Sign in with Google (beta) or an app password. Outlook takes Sign in with Microsoft (beta).
CodeCatch only reads mail. It never marks, moves or changes a message.
- Install the Bitwarden CLI and run
bw loginonce. - In CodeCatch, open Settings → Sources → Bitwarden → Set Up….
CodeCatch keeps only each login's name, username, site and TOTP secret, in your Keychain. It makes codes offline, and you unlock them with Touch ID or your Mac password.
Claude Code, Codex and scripts can ask for a code while they sign in for you.
- Open Settings → Agents and turn on Let Agents Ask for Codes. This also
adds
codecatchto/usr/local/bin. - Click Connect next to Claude Code, Codex or Cursor. This adds a small skill the agent loads only when it needs a code. For other agents, copy the text under Other Agents into their instructions.
codecatch get github.com --jsonYou approve each code with Touch ID, choose Always Allow for a site and
app, or turn on Allow All Without Asking, which also needs Touch ID.
Sign-in links have their own switch, off until you turn it on. Only mail from
the site's own domain counts. Nothing goes over the network. codecatch --help
has the rest.
Codes and messages stay on your Mac. Received codes live in memory only. Mail
passwords and Bitwarden secrets live in your login Keychain (service
com.uros.codecatch). CodeCatch connects only to your mail provider, Bitwarden
when you import, Google or Microsoft if you sign in with them, codecatch.app
for updates, and Google's or DuckDuckGo's logo service (turn off in
Settings → Privacy).
The full list is at codecatch.app/privacy. How it works inside is in ARCHITECTURE.md.
Looking for a 2FHey or MessAuto alternative that also reads mail, catches sign-in links (magic links) and works in Chrome, Arc and Firefox? See CodeCatch vs 2FHey and CodeCatch vs MessAuto.
See CONTRIBUTING.md. Run the tests with scripts/test.sh.
GPL-3.0. If you share a fork or a build, you must publish its source under the same license. To report a security problem, see SECURITY.md.