Generator/Privacy
No secret, ever. There is no account and no server to send a key to. Google Analytics does measure page visits, which is the one thing here that talks to anyone else — details below.
A key you paste lives in the tab's memory and is discarded when the tab closes. It is never transmitted, because there is nowhere to transmit it to.
Saving is opt-in and off until you ask for it. Nothing reaches this browser's storage unless you add a key and then choose to save the list. If you do, the accounts are encrypted with AES-GCM under a key derived from your passphrase (PBKDF2-HMAC-SHA256, 310,000 iterations) and only the ciphertext is written. The passphrase itself is never stored in any form, which also means there is no recovery path: lose it and the saved accounts cannot be read, by us or by anyone.
Every page ships under a Content-Security-Policy. It permits requests only to this origin and to Google's analytics endpoints, and nothing else — no other destination can be reached from these pages, and the key is never part of what analytics sends.
Worth being precise about a trade-off. An earlier version of this site set connect-src 'none', which let the browser itself guarantee that nothing could be transmitted anywhere. With analytics present that is no longer the case, so “no key is transmitted” now rests on this site's code rather than on the browser refusing outright.
You can still check the part that matters: load the page, disconnect from the network, and it keeps producing codes from your device clock.
Scanning a QR code asks for camera permission and decodes frames locally. No image leaves the device, nothing is uploaded, and the stream is stopped as soon as a code is read or you press Stop.
At most two things, both in localStorage. Your light or dark preference, under hm_theme. And, only if you opted in, the encrypted vault under gen2fa_vault — ciphertext, a random salt and a random initialisation vector, with nothing readable in it. Clear site data and both are gone.
Storage is per-browser. Nothing is synced to another device, because there is no account and no server to sync through.
Google Analytics runs on every page. It records which pages are visited, roughly which country the visit came from, and the browser and device type, and it sets its own cookies (_ga and _ga_*). That data goes to Google and is handled under Google's privacy policy, not this one.
It never receives a setup key, a generated code, or anything you type. Those stay in the tab, and nothing in this site's code passes them to the tag.
If you would rather not be counted, a content blocker or your browser's tracking protection will stop the tag loading, and the generator behaves exactly the same without it.
Service names and logos belong to their owners and are used to identify the service a guide describes. Gen2FA is not affiliated with, endorsed by, or connected to any of them.