About
2FA

2FA turns a Base32 secret into a standard time-based verification code. It runs as a static page and keeps the calculation in your browser.

Privacy boundary

The application has no account system, analytics, cookies, or remote scripts. Your secret and generated codes are held in memory only. The sole saved preference is your color theme.

Your browser, installed extensions, operating system, and anyone with access to your screen or clipboard remain outside that boundary.

Links containing a secret

A secret may be supplied after the URL hash:

https://2fa.pgp.im/#YOUR_SECRET

The hash is not included in an HTTP request, but it can remain in browser history, bookmarks, synced tabs, and screenshots. The page removes it from the address bar after reading it.

Legacy path links are still accepted, but the path may already have been recorded by a server. Avoid them for new links.

Compatibility

The generator uses the common TOTP profile: HMAC-SHA-1, six digits, and a 30-second period. Base32 keys and compatible otpauth:// URIs are accepted.

Device time must be accurate. A clock that is out of sync will produce codes that services reject.

Project

The project is maintained privately by @alue. The deployed utility remains a static page and performs TOTP calculations entirely in the browser.