Current code Example account
Local Secret handling Never leaves this browser
No account. No upload. No tracking.
Your 2FA code stays yours.
A clean, privacy-first TOTP authenticator that computes codes on your device—paired with practical guides that make account security easier to understand.
Browser-only
Zero storage
RFC 6238
01
Paste securelyYour key remains on-device.
02
Use instantlyNo signup or sync needed.
Designed around three promises
0secret-related API calls
0accounts required
100%on-device computation
Privacy by architecture
Security you can understand.
2FAOTP avoids the usual cloud trade-off. The tool does one focused job, with fewer moving parts and no database holding your secrets.
Nothing to upload
Your Base32 secret is read by local JavaScript and passed directly to the browser's cryptographic engine.
Works after loading
TOTP is based on a shared secret and your device clock. Code generation needs no account and no live server response.
Clear, honest guidance
We explain what the tool can protect, what it cannot, and when a dedicated authenticator is still the safer choice.
How TOTP works
One secret. One clock. A code that keeps moving.
Your service and authenticator both hold the same secret. Every 30 seconds they independently combine it with the current time. Matching results confirm that you possess the secret—without transmitting it during sign-in.
Read the complete explanation →- 1 Enter a Base32 secret
Usually shown below a 2FA setup QR code.
- 2 Compute with Web Crypto
HMAC combines the secret with a time counter.
- 3 Use the short-lived code
The code expires at the end of its time window.
Security field notes
Make stronger choices.
Fundamentals · 7 min read
How TOTP works without sending you a message
Understand the shared secret, time counter, HMAC calculation, and why a six-digit code changes every 30 seconds.
Comparison · 6 min read
TOTP vs SMS: which second factor should you choose?
Compare authenticator codes and text messages across phishing resistance, account recovery, travel, and everyday convenience.
Recovery · 6 min read
How to store 2FA backup codes without creating a new risk
Build a recovery plan that survives a lost phone while keeping single-use backup codes away from account attackers.
Ready when you are