ANONYMOUS 2FA
中文

2fa codes

computed locally · secrets never leave your browser

secrets

One per line: a bare secret, "label | secret", an otpauth:// link or a Google Authenticator export link. Spaces and case are ignored.

options

Type
Digits
Period
Algorithm

These options apply to bare secrets; otpauth:// links carry their own.

Device time --:--:--

TOTP needs an accurate clock. If codes are always rejected, sync your device clock or compensate with the offset above.

privacy

  • Codes are computed entirely in your browser. Secrets are never sent anywhere.
  • Nothing is stored: no cookies, no localStorage, no browser storage of any kind.
  • A Content Security Policy forbids this page from making any network request.
  • Codes blur when you switch windows; everything is wiped after 5 idle minutes or when you leave.
File checksums (SHA256SUMS)

About

A privacy-first online two-factor authentication (2FA) tool. Paste your TOTP secret and see the same 6-digit codes as Google Authenticator, Microsoft Authenticator and other apps.

Everything is computed in your browser: secrets are never sent to a server and never written to cookies or local storage. Codes blur when the window loses focus, and everything is wiped after 5 idle minutes or when you leave.

Features

Batch codes

One secret per line, dozens of accounts at once, with the next code and a countdown. Click to copy.

QR import

Upload or paste a 2FA QR screenshot and the secret is decoded locally, including Google Authenticator export (migration) codes with many accounts.

Create secrets

Generate strong random secrets for your own services, with an otpauth link, QR code and live code for verification.

Full standards

TOTP (RFC 6238) and HOTP (RFC 4226), SHA1 / SHA256 / SHA512, 6–8 digits, 30 / 60 s periods, clock offset correction.

Real privacy

A Content Security Policy blocks all network requests from the page. No analytics, no cookies, no server access logs.

Tor onion service

Its own .onion address; Tor Browser offers to switch automatically.

FAQ

What is a 2FA secret and where do I find it?

When you enable two-factor authentication, the site shows a QR code and usually a "setup key" made of letters A-Z and digits 2-7. That is the TOTP secret.

Is it safe to enter a 2FA secret on a website?

Here codes are computed entirely in your browser and the page is forbidden from making network requests, so the secret never leaves your device. Still, anyone who sees your secret can generate codes, so do not use it on untrusted devices.

Why are my codes rejected?

TOTP depends on an accurate clock. Make sure your device time is synced, or compensate with the clock offset slider. Also check digits, period and algorithm.

Can I import accounts from Google Authenticator?

Yes. In Google Authenticator choose "Transfer accounts → Export accounts", screenshot the QR code and upload or paste it under "scan qr".

Are my secrets kept after I close the page?

No. Nothing is stored; closing or reloading the page wipes everything, so keep your own backup of the secrets.

Why does it ask for JavaScript?

Codes are computed locally with JavaScript. In Tor Browser, set the security level to "Safer" instead of "Safest".