77Fox is a Windows desktop app with a browser extension that solves two different "verification code" problems in two deliberately separate ways. OTP delivery relays one-time codes from an iPhone SMS Shortcut and from email over IMAP to the browser, where a short-lived candidate appears beside the input field and you click to fill it. Image CAPTCHA recognition runs OCR on your own machine for supported text, arithmetic, point-click and slider cases, and the image never leaves the device. One path is a brief cloud relay of a six-digit code; the other is strictly local, and it never quietly falls back to the cloud when OCR is unavailable.
This guide explains both paths, how long anything is retained, which fields are excluded, and how to set them up.
The two paths at a glance
| OTP delivery (SMS and email) | Image CAPTCHA recognition | |
|---|---|---|
| Source | iPhone SMS via an iOS Shortcut; email via IMAP | The CAPTCHA image on the current page |
| Where processing happens | Message bodies parsed briefly in restricted server memory; candidates relayed to your browser | OCR on your device (ddddocr-style local recognition) |
| What is retained | Verification candidates, redacted sources, timestamps and consumption state, normally for no more than five minutes | Nothing; results are returned to the extension on the same machine |
| What is never stored | Full SMS or email bodies are not written to disk, databases or logs | The image never leaves the device |
| Cloud fallback | Not applicable | Never; a failed local recognition ends there |
| Where it fills | Beside a reliably identified input field; you click to fill | The field on the current page; slider and click captchas take over the page only briefly |
| Excluded fields | Payment PIN, CVV, ordinary passwords and similar | Not applicable |
| Plan | Cloud verification codes are listed among the features included in every 77Fox plan | Local, free |
Path one: OTP delivery from phone and inbox to the browser
The problem
Logging into many AI services, client back offices or server panels turns into a loop of reaching for the phone, opening the mail client, and copying six digits into the browser. Freelancers, multi-account operators and developers do this dozens of times a day.
How it works
- Bind the sources on the desktop. The 77Fox desktop app manages the iPhone binding (an iOS SMS Shortcut) and the mailbox connection (IMAP). Mail app passwords or IMAP authorisation codes are stored with AES-256-GCM encryption.
- A code arrives. The message body is parsed briefly in restricted server memory to extract the code. It is not written to disk, databases or logs.
- A candidate appears in the browser. The extension shows the candidate beside a reliably identified input field. Filling and submission remain under your control; the extension offers, you click.
- The candidate expires. Only the verification candidate, a redacted source, timestamp and consumption state are retained, normally for no more than five minutes.
The desktop app keeps the connection state and status; the extension exposes short-lived candidates only where a matching field exists.
What it will not touch
Payment PIN, CVV, ordinary password and similar fields are excluded. Codes are treated as short-lived events, not as content, and SMS and email bodies are never retained as long-term content.
Path two: CAPTCHA recognition that stays on the device
The problem
Console logins, test environments and server panels throw simple image codes at you all day. Typing them is tedious; sending the images to a cloud service is a privacy cost most people would rather not pay for a login form.
How it works
The desktop app manages the local recognition environment; the extension fills the field on the current page. Supported cases cover text, arithmetic, point-click and slider captchas. Slider and click captchas take over the page temporarily, just when needed, and release it immediately afterwards.
The boundary is strict: images are processed locally only, and a failed recognition ends there. It never falls back to the cloud, so a login form's image is never sent anywhere, even when local OCR is unavailable.
Why the two paths are kept apart
A code arriving by SMS is inherently a message that has to travel from your phone to your browser; the design minimises what is kept and for how long. A CAPTCHA image is already in front of you and has no reason to travel at all; the design keeps it on the machine. Treating "verification codes" as one feature would force the weaker boundary onto both. Keeping them separate means each gets the tightest boundary its job allows.
How it fits the dashboard
The 77Fox dashboard centralises extension service status, iPhone and mailbox bindings, and the local OCR environment. The browser offers a candidate only beside an appropriate field, while filling and submission stay under user control. Verification becomes part of the workflow rather than another loose utility.
FAQ
Are message and email bodies retained?
No. Verification codes are handled as short-lived events. Bodies are parsed briefly in restricted server memory and are not written to disk, databases or logs; only candidates, redacted sources, timestamps and consumption state are kept, normally for no more than five minutes.
If local captcha recognition fails, does it try the cloud?
No. Local recognition ends there and never falls back to the cloud. The image itself never leaves your machine.
Does the extension fill the code automatically?
It shows a candidate beside the field; you click to fill. Submission remains under your control.
Which fields are excluded?
Payment PIN, CVV, ordinary password and similar fields are never filled.
Does this need the desktop app?
Yes for the SMS and email connections and for local recognition. The desktop app manages the bindings and the OCR environment; the extension works on the page.