Is it safe to use an online authenticator?
Codes are calculated locally using your browser’s cryptographic tools. The website does not receive your keys. Local profiles are not encrypted with a master password, however: someone with access to your browser data could read them. Use a trusted device and keep the browser and operating system up to date.
Are my secret keys stored online?
No. Profiles are stored in IndexedDB in this browser. There is no account, server database or automatic cloud sync. Clearing site data can remove the profiles. Save an encrypted backup before changing browsers or devices.
Why is my code not working?
Check that the time on your device is set automatically. Make sure the key, algorithm, number of digits and update interval match your service. Try the next code if the current one is about to expire.
Do I need an account?
No. There is no sign-up or login for the authenticator. Your browser stores your profiles. The tool does not change the login requirements of the services you use.
Which authenticators and services are compatible?
Standard TOTP keys and otpauth://totp/ links are supported. The available algorithms are SHA-1, SHA-256 and SHA-512, with 6 or 8 digits. HOTP, SMS codes, push approvals and proprietary token formats are not supported. A service’s brand name alone does not guarantee TOTP compatibility.
How do I move my profiles to another device?
Export a password-encrypted .2fa backup, transfer the file yourself and import it on the other device with the same password. There is no automatic sync. Keep the backup password separate from the file.
What happens if I clear browser data?
Your saved profiles can be deleted. Private browsing and automatic browser cleanup can also remove them. A local profile has no fixed expiration date, but storage is not guaranteed. Keep a backup and your services’ recovery codes.
Can I import a QR code?
You can read a PNG, JPEG or WebP QR image locally if your browser supports the Barcode Detection API. If it does not, paste the setup key or otpauth link. Camera scanning and proprietary multi-account QR migration formats are not included.
Can I recover a forgotten backup password?
No. Backup encryption happens on your device and the password is not saved. Without the password, the encrypted file cannot be restored by 2fas.online.
Why did my profiles disappear on a different address?
Browsers separate storage by origin: scheme, hostname and port. A preview, www.2fas.online, 2fas.online and another device do not share profiles. Export before moving and use one consistent HTTPS address.
Can I use this without internet?
Yes, once a supported browser has cached the website. Codes are calculated from the local key and device time. Caching may be unavailable or cleared; in that case you need a connection to load the page again.