Generator/About
A two-factor code generator that runs entirely in the page you are reading, built to stop the walk to another room for six digits. Paste the setup key a service gave you, or scan its QR code, and the code appears.
It started as an irritation with my own setup. I use Google Authenticator, and the phone it lives on is often not where I am — on charge in another room, or simply left somewhere while I am working at a desk.
So the routine went like this. A site asks for a code. I get up, find the phone, unlock it, open the app, find the right account, and read six digits that expire in under thirty seconds. Then back to the keyboard to type them before they roll over. Miss the window and you do it again.
The worst version is turning 2FA on. You are already at the computer, the setup key is on the screen in front of you, and the service wants a code from that very key to confirm the enrollment. The information needed to produce it is right there — and you still walk to another room to read a number off a phone.
That is the whole reason this exists. TOTP has no registration step: any authenticator holding the key produces the same digits, so there is no technical reason the code has to come from the phone. Paste the key, read the code, carry on — without getting up.
It is deliberately not a replacement for the app, and I still keep mine enrolled. The app is the thing that survives a cleared browser and moves to a new phone. This is for the moment the app is out of reach, which in my experience is most moments.
Gen2FA implements TOTP as specified in RFC 6238: the shared secret and the current 30-second time step are run through HMAC, and the result is truncated to the digits you see. Every authenticator app does the same arithmetic, which is why a code from here and a code from a phone app match for the same key at the same moment.
Keys that specify SHA-256 or SHA-512, eight digits, or a non-standard period are handled too — those settings ride along inside an otpauth:// link, and you can set them by hand under Advanced.
A 2FA secret is a long-lived credential. Anything that transmits one is asking to be trusted forever, and that trust cannot be checked from outside. So there is nothing to transmit to: every page is prerendered at build time and served as a static file, and the running code has no backend to call.
Pages ship with a Content-Security-Policy that permits requests only to this origin and to Google's analytics endpoints, so there is no route from here to anywhere else, and the key is never part of what analytics sends. Disconnect from the network and the generator keeps working from your device clock. Details, including what changed when analytics was added, are in the privacy notice.
It is not a password manager and not a replacement for an authenticator app. Nothing is synced and nothing is backed up. A key you paste in the field at the top is gone when the tab closes; one you add to the list is saved in this browser in readable form, on this device only. It is built for reading a code when you need one — recovering an account, moving to a new phone, checking whether a key was transcribed correctly — not for storing your credentials. The disclaimer is blunter about the consequences.
Each service guide names where that service hides the text key behind its QR code and which algorithm it issues, because those differ and getting one wrong produces codes that never work. The parameters on each page are checked against the live service rather than copied from a list.
Service names and logos belong to their owners and are used to identify the service a guide describes. Gen2FA is not affiliated with, endorsed by, or connected to any of them.