Generator/Disclaimer
A 2FA setup key is not a password you can change after a scare. It is the seed every future code is derived from, and anyone holding it can produce valid codes for that account indefinitely.
Nothing is synced and nothing is backed up. By default keys live in the tab and are gone when it closes, so this cannot be your only copy of a key. Keep the recovery codes the service issued, or enrol the key in an app that persists it.
Saving accounts in this browser does not change that. The vault is encrypted under a passphrase that is never stored, which means there is no reset and no recovery — forget it and the saved keys are unreadable. It also lives in one browser profile on one device, so clearing site data, reinstalling, or switching machines loses it. Treat it as a convenience, never as a backup.
There is no server to send a key to, and the Content-Security-Policy blocks outbound requests at the browser level, so a key cannot leave the page over the network even if the code tried. That is checkable: go offline and it keeps generating. The privacy notice shows how.
The guarantee stops at the edge of the page. A compromised device, a malicious browser extension with permission to read page contents, malware, or someone watching the screen all sit outside it. A key pasted on a machine you do not trust should be treated as disclosed, and the second factor reset at the service.
Take the same care with the key itself: it usually appears in the browser's form history if typed into other sites, and a screenshot of a QR code is the key in plain sight. Do not paste a key on a shared or public computer.
TOTP is a function of the shared secret and the current time. If the device clock is wrong by more than about thirty seconds, every code will be rejected even though the key is correct. That is a symptom of the clock, not of the key — the troubleshooting guides cover how to tell the difference.
Service interfaces change. The parameters and steps published here are checked against the live service when written, but no representation is made that they remain current, and they are not security advice for your particular situation. Verify anything consequential against the service's own documentation.
Gen2FA accepts no liability for lost account access, rejected codes, disclosure of a key from a device outside its control, or any other loss arising from use of this site. See the terms.