Generator/About
A two-factor code generator that runs entirely in the page you are reading. Paste the setup key a service gave you, or scan its QR code, and the six digits appear.
Gen2FA implements TOTP as specified in RFC 6238: the shared secret and the current 30-second time step are run through HMAC, and the result is truncated to the digits you see. Every authenticator app does the same arithmetic, which is why a code from here and a code from a phone app match for the same key at the same moment.
Keys that specify SHA-256 or SHA-512, eight digits, or a non-standard period are handled too — those settings ride along inside an otpauth:// link, and you can set them by hand under Advanced.
A 2FA secret is a long-lived credential. Anything that transmits one is asking to be trusted forever, and that trust cannot be checked from outside. So there is nothing to transmit to: every page is prerendered at build time and served as a static file, and the running code has no backend to call.
Pages ship with a Content-Security-Policy that permits requests only to this origin and to Google's analytics endpoints, so there is no route from here to anywhere else, and the key is never part of what analytics sends. Disconnect from the network and the generator keeps working from your device clock. Details, including what changed when analytics was added, are in the privacy notice.
It is not a password manager and not a replacement for an authenticator app. Nothing is synced and nothing is backed up. A key you paste is gone when the tab closes unless you explicitly save it here under a passphrase, and even then it stays in this one browser and nowhere else. It is built for reading a code when you need one — recovering an account, moving to a new phone, checking whether a key was transcribed correctly — not for storing your credentials. The disclaimer is blunter about the consequences.
Each service guide names where that service hides the text key behind its QR code and which algorithm it issues, because those differ and getting one wrong produces codes that never work. The parameters on each page are checked against the live service rather than copied from a list.
Service names and logos belong to their owners and are used to identify the service a guide describes. Gen2FA is not affiliated with, endorsed by, or connected to any of them.