Generator/Privacy
No secret, ever. There is no account and no server to send a key to. Google Analytics does measure page visits, which is the one thing here that talks to anyone else — details below.
A key you paste lives in the tab's memory and is discarded when the tab closes. It is never transmitted, because there is nowhere to transmit it to.
An account you add to Your accounts is different, and you should know exactly how. It is saved in this browser so it survives a reload, and it is saved as readable text — the key included. There is no passphrase and nothing is encrypted. Anyone who can use this browser profile, and any extension permitted to read this site's data, can read those keys.
It still never leaves the device: nothing is uploaded, synced or sent anywhere. But on a shared or work computer, treat adding an account as writing the key down. Use Clear all to remove it, or simply do not add it and use the field at the top, which keeps nothing.
Every page ships under a Content-Security-Policy. It permits requests only to this origin and to Google's analytics endpoints, and nothing else — no other destination can be reached from these pages, and the key is never part of what analytics sends.
Worth being precise about a trade-off. An earlier version of this site set connect-src 'none', which let the browser itself guarantee that nothing could be transmitted anywhere. With analytics present that is no longer the case, so “no key is transmitted” now rests on this site's code rather than on the browser refusing outright.
You can still check the part that matters: load the page, disconnect from the network, and it keeps producing codes from your device clock.
Scanning a QR code asks for camera permission and decodes frames locally. No image leaves the device, nothing is uploaded, and the stream is stopped as soon as a code is read or you press Stop.
One thing: the accounts you have added, in localStorage under gen2fa_accounts, as plain readable JSON. Clear site data, or use Clear all, and it is gone. Add nothing and the site writes nothing.
Storage is per-browser. Nothing is synced to another device, because there is no account and no server to sync through.
Google Analytics runs on every page. It records which pages are visited, roughly which country the visit came from, and the browser and device type, and it sets its own cookies (_ga and _ga_*). That data goes to Google and is handled under Google's privacy policy, not this one.
It never receives a setup key, a generated code, or anything you type. Those stay in the tab, and nothing in this site's code passes them to the tag.
If you would rather not be counted, a content blocker or your browser's tracking protection will stop the tag loading, and the generator behaves exactly the same without it.
Service names and logos belong to their owners and are used to identify the service a guide describes. Gen2FA is not affiliated with, endorsed by, or connected to any of them.