Generator/Disclaimer
A 2FA setup key is not a password you can change after a scare. It is the seed every future code is derived from, and anyone holding it can produce valid codes for that account indefinitely.
Nothing is synced and nothing is backed up. By default keys live in the tab and are gone when it closes, so this cannot be your only copy of a key. Keep the recovery codes the service issued, or enrol the key in an app that persists it.
Accounts you add to the list are saved in this browser as readable text, with no passphrase and no encryption. That is a convenience, and it has a cost: anyone who can use this browser profile can read those keys, as can any extension allowed to read the site's data. Do not add accounts on a shared, public or work machine — paste the key in the field at the top instead, which saves nothing.
It is also not a backup. The list lives in one browser profile on one device, so clearing site data, reinstalling or switching machines loses it. Keep the recovery codes the service gave you.
There is no server to send a key to, and the Content-Security-Policy blocks outbound requests at the browser level, so a key cannot leave the page over the network even if the code tried. That is checkable: go offline and it keeps generating. The privacy notice shows how.
The guarantee stops at the edge of the page. A compromised device, a malicious browser extension with permission to read page contents, malware, or someone watching the screen all sit outside it. A key pasted on a machine you do not trust should be treated as disclosed, and the second factor reset at the service.
Take the same care with the key itself: it usually appears in the browser's form history if typed into other sites, and a screenshot of a QR code is the key in plain sight. Do not paste a key on a shared or public computer.
TOTP is a function of the shared secret and the current time. If the device clock is wrong by more than about thirty seconds, every code will be rejected even though the key is correct. That is a symptom of the clock, not of the key — the troubleshooting guides cover how to tell the difference.
Service interfaces change. The parameters and steps published here are checked against the live service when written, but no representation is made that they remain current, and they are not security advice for your particular situation. Verify anything consequential against the service's own documentation.
Gen2FA accepts no liability for lost account access, rejected codes, disclosure of a key from a device outside its control, or any other loss arising from use of this site. See the terms.