What happens to a secret
The authenticator normalises the Base32 text and passes its decoded bytes to the browser's Web Crypto API. It combines the secret with a time counter and renders the resulting TOTP code. There is no secret-processing endpoint, account database, cloud synchronisation feature, or form submission. See how TOTP works for the full calculation, step by step.
The secret is not deliberately placed in cookies, local storage, session storage, IndexedDB, URL parameters, browser history, analytics events, or server logs. Refreshing or closing the page removes the application's reference to it.
Origin isolation
Educational content and advertising belong on the public website. The authenticator is deployed separately and does not load advertising, behavioural analytics, remote fonts, chat widgets, or tag managers. Browser same-origin protections therefore separate content-site scripts from the page that handles the secret.
Security headers and deployment
The tool uses a restrictive Content Security Policy that disables outbound connections, framing, plugins, forms, and third-party code. Production deployment enforces HTTPS, MIME sniffing protection, a strict referrer policy, and browser capability restrictions.
Azure infrastructure is defined as code. Production releases should use short-lived workload identity credentials, reviewed deployments, dependency scanning, and an edge firewall. The origin can be restricted to traffic from the configured Azure Front Door instance.
Important limitations
A web page cannot defend against a compromised browser, malicious extension, infected operating system, screen recorder, clipboard monitor, or someone with physical access to an unlocked device. JavaScript also cannot guarantee that a value has been physically erased from all browser memory.
For long-term storage, use a reputable authenticator or password manager with encrypted backups. Treat any online authenticator as a temporary utility, verify the domain every time, and never enter a secret received from an unknown source. Where a service supports it, passkeys are a stronger option than TOTP— and keep backup codes stored safely in case you lose access to this device.
Responsible disclosure
If you discover a vulnerability, email security@example.com. Include the affected URL, clear reproduction steps, impact, and any minimal proof needed to understand the issue. Do not access another person's data, disrupt availability, or publish an unpatched vulnerability.
Replace the example security address with a monitored mailbox before production launch. A machine-readable policy is available at /.well-known/security.txt.