Is my secret key sent anywhere?

No. The key stays in the tab's memory. The page's Content-Security-Policy sets connect-src to none, so the browser itself blocks any outbound request.

Why is my 2FA code being rejected?

Almost always device clock drift. TOTP derives the code from the current time, so a clock off by more than about 30 seconds produces codes the server will not accept. Turn on automatic time sync and try again.

Does this work offline?

Yes. After the page loads it makes no network requests at all — disconnect and it keeps generating codes from your device clock.

Generate your 2FA code

Paste the setup key a site gave you, or scan its QR code. The six digits appear below, worked out in your browser and never sent anywhere.

Waiting for a keypaste one above to start20

——————

Your accounts

No accounts here. Add a key and it stays until you close this tab.

Nothing is stored. The key stays in this tab and is gone when you close it. No localStorage, no history list, no third-party script on this page.

Getting the key out of the site

STEP 1

Ask for the text key

On the 2FA screen, choose “authenticator app”, then look for can’t scan the QR code. That reveals the Base32 setup key, usually 16 or 32 characters of A–Z and 2–7.

STEP 2

Paste or scan it

Spaces and dashes are ignored. Upload the QR image, drop it on the field, or scan it with a camera — the issuer and parameters come straight out of it.

STEP 3

Keep a backup

Save the same key in a password manager, and keep the site’s recovery codes offline. A browser tab is a second factor, not a backup plan.

Setup guides

GitHubSHA-1 · 30s DiscordSHA-1 · 30s BinanceSHA-1 · 30s CoinbaseSHA-1 · 30s KrakenSHA-512 AWS IAMtwo codes CloudflareSHA-1 · 30s XSHA-1 · 30s FacebookSHA-1 · 30s BitwardenSHA-1 · 30s ProtonSHA-1 · 30s Steam5-char alphabet

Each guide covers where that service hides the text key, the parameters it issues, and its recovery path.

Privacy

No account, no cookie banner, no third-party script. Everything ships from this origin under a Content-Security-Policy with connect-src 'none', so the browser blocks any outbound request. Load the page once and it keeps working offline.