Skip to content
2FAAuthenticator
Free · No ads · No tracking

Your two-factor codes, right in your browser.

Paste any TOTP or HOTP setup key and watch live codes appear instantly — no phone needed. Keep everything on your device, or create an account to sync it securely everywhere.

A real code rotating every 30 seconds — yours will look exactly like this.

  • AES-256-GCM encrypted at rest
  • scrypt-hashed passwords
  • Zero third-party trackers

Works on desktop and mobile — install it as your web authenticator.

Your authenticators

This browser only

Three steps, thirty seconds

From setup key to working code faster than pulling out your phone.

  1. Step 1

    Copy your setup key

    When enabling 2FA on any website, look for “enter key manually” or “can't scan” — copy the setup key it shows you.

  2. Step 2

    Paste it into the vault

    Press Add authenticator, paste the key, give it a name. A live preview shows the code immediately so you can verify it matches.

  3. Step 3

    Tap to copy, forever

    Codes rotate on their own with a countdown ring. Tap a card whenever a login asks for your code — it's copied.

A complete authenticator, not a toy

Everything you'd expect from an authenticator app — in a tab you already have open.

Every standard 2FA type

TOTP with SHA-1, SHA-256 or SHA-512, 6–8 digit codes, 15/30/60 second refresh — plus counter-based HOTP and Steam Guard's 5-character codes.

Use it without an account

Credentials are saved straight into your browser's local storage and cache. Nothing leaves your device until you decide to sync.

Encrypted account sync

Create an account and your secrets are encrypted with AES-256-GCM before they ever touch the database — then follow you to any browser.

Live codes, zero friction

Codes rotate automatically with a live countdown ring. Tap any card and the code is on your clipboard — sized for thumbs on mobile.

Move anywhere with QR

Show a standard otpauth QR code to transfer a credential to your phone's authenticator — or scan QR codes straight into the vault.

Backup & restore

Export everything to a JSON backup file and import it back anytime. Local mode and account mode both support it.

For security reasons, account secrets are only ever decrypted server-side to compute your next code — revealing one requires your password again.

Frequently asked questions

Everything people usually want to know before trusting a web authenticator.