2FA Authenticator

What is a 2FA authenticator?

Two-factor authentication (2FA) adds a second layer of security to your accounts. Even if someone steals your password, they still need access to your authenticator to log in. This tool generates TOTP (Time-based One-Time Passwords, RFC 6238), HOTP (HMAC-based One-Time Passwords, RFC 4226), and Steam Guard codes in your browser.

A TOTP code is computed by hashing your secret key with the current time window (typically 30 seconds). Each code is valid for one period only. HOTP codes use an incrementing counter instead of time. Steam Guard uses the same 30-second HMAC base, but displays a non-standard 5-character Steam alphabet code.

Is it safe to use a browser-based authenticator?

Yes — with important caveats. This tool stores your 2FA secrets in your browser's localStorage. They are never transmitted to any server. All code generation happens locally using the Web Crypto API. The main risk is browser data loss — always keep an encrypted backup using the export feature. For high-security accounts (banking, crypto wallets), a dedicated hardware key or offline authenticator app is still recommended.

How do I move my 2FA codes to a new device?

Use Export → Encrypted JSON backup to create a password-protected backup file. On your new device, open this tool, click ⋯ → Import accounts, drop in the file, and enter your password. All accounts will be restored instantly.

Alternatively, use Export → Migration QR to generate a standard otpauth-migration:// QR code. Scan it with Google Authenticator, Aegis, or any compatible app to transfer your accounts.

What services support TOTP 2FA?

Most major platforms support TOTP-based 2FA: GitHub, Google, Stripe, AWS, Cloudflare, Dropbox, Twitter/X, Discord, Binance, and hundreds more. Look for "Authenticator app" or "TOTP" in your account's security settings. Steam Guard is separate, but can be added if you already have a Steam authenticator secret backup.