1. Enable TOTP on your account
Open the security settings of the service you want to protect. Choose an authenticator app or TOTP option. The service usually shows a QR code and a manual setup key. Keep its recovery codes somewhere safe.
2. Add the setup key to 2fas.online
Paste the key or an otpauth://totp/ link into the form on the home page. The code appears and the profile is saved automatically in this browser. The name is optional. Edits in a card update only that profile. Choose Add profile to open a new card after the saved profiles. Each card has its own code and timer. Standard settings are SHA-1, six digits and a 30-second interval. A valid authenticator link can supply SHA-256, SHA-512, eight digits or another interval. Do not change these unless your service specifies them.
3. Confirm the current code
Click the code to copy its digits without spaces, then paste it into the service’s verification field. Complete the setup there. Adding a profile here does not enable or change two-factor authentication at the service itself.
Why both sides get the same number
TOTP uses the shared key and a counter derived from Unix time. An HMAC calculation produces a value that is shortened to the requested number of digits. Your service uses the same inputs to verify the result. 2fas.online implements the algorithm described in RFC 6238.
The countdown follows the current clock; it does not start a new 30-second window when you open this page. If you return from a background tab, the display recalculates from the current time. Enable automatic date and time on your device if codes do not match.
4. Make an encrypted backup
Choose Export and set a long, unique backup password. Download the encrypted .2fa file. To move profiles to another browser or device, open 2fas.online there, choose Import and enter the password. Existing profiles are kept; matching keys and settings are skipped.
Using the site offline
The first visit needs an internet connection. Where service workers and storage are available, the site caches its static files. Once cached, saved codes can be generated without a connection. If your browser clears site data or disables caching, reconnect to load the page again. Your device clock must still be correct.