2FA Authenticator: Every Code on One Page, Kept in One Link

Every authenticator app assumes you own the phone it lives on. That works right up until the phone is in the other room, or the code you need belongs to a shared account, or you are on a machine that is not yours and the login screen is waiting.

This page holds up to thirty two-factor accounts and shows every code at once, each with its own countdown. Add GitHub, the work email and the bank, and all three sit in front of you, rolling over together.

Your accounts stay in this browser, so bookmark the plain page address and they are waiting next time. Nothing reaches this site, because there is no account here and no server to send anything to.

Each account also has its own share link, about fifty characters long. That is the piece you keep beside a login in a spreadsheet or a password note: double-click it and the code is on screen.

Paste your key however you happen to have it. Spaces, hyphens, capitals, trailing equals signs, even the %20 escapes you get when a key has been through a browser address bar, all of it comes off before the key is stored, and the page tells you what it changed.

1. Paste a secret key into the top box. A raw Base32 key works, and so does a whole otpauth:// link, which fills in the name, digit count, window and hash for you.
2. Give it a name, such as GitHub, work email, or the bank. Anything that means something to you next month.
3. Press Add account. The code appears straight away with a ring counting down the seconds until it rolls.
4. Add the rest of your accounts the same way. Reorder them with the arrows so the one you use daily sits at the top.
5. Your accounts are saved in this browser as you add them, so a refresh, a closed tab and a plain bookmark of this page all bring them back. They are stored unencrypted unless you set a master password under Settings, and clearing your browsing data removes them, so keep a share link or a backup file for anything you cannot re-enrol.
6. Fold the Add an account box away with its header once you are done. It stays folded on your next visit and every one after it, until you open it again. Most days you are here to read a code rather than to add one, and the box is the thing in front of the code.

Three places, and they answer different questions.

This browser, automatically, from the moment you add an account. It is what makes a refresh and a plain bookmark work, and it needs no setup. It is also not encrypted: the keys sit in this browser's storage in readable form, so anything with access to this profile can read them. That is the same trade every browser password manager makes before you set a master password, and Settings is where you change it.

A link, when you press the share button on an account. This is the only copy that travels, whether that is to a spreadsheet cell, a note, a colleague or another machine.

A backup file or the encrypted vault, both under Settings, for when the browser store is not enough. Clearing your browsing data wipes this browser and takes your accounts with it, which is the failure a backup exists for.

Clearing your own browsing data is the obvious way, and it is not the common one, because you know the moment you have done it.

The common one is a cleanup tool. A PC optimiser, a privacy extension, the tidy-up bundled with an antivirus, the scheduled clean somebody set up once a year ago and has not thought about since. They all clear site data, which is the category a browser files your accounts under, and none of them will name this site while doing it. You find out at a login screen, holding no way in.

There is nothing we can do about it afterwards. There is no account here and no server, so there is nothing on our side to restore from, and the way back is through each service rather than through this page: recovery codes if you kept them, otherwise the service's own account recovery, then setting two-factor up again from scratch. That is why the page asks you to export a file every time you add an account, and why it asks next to the button rather than behind an info icon.

What the page can do from its side, it does. It asks your browser to treat this site's storage as persistent, which stops the loss you did not ask for: a browser short of disk evicting a site it has decided is disposable, and Safari's habit of clearing script-written storage for sites you have not been back to lately. Browsers decide that for themselves and frequently say no, and it is worth nothing at all against a cleanup tool, because clearing site data is an instruction and a persistent site follows an instruction like any other. A file on disk is the only copy that survives everything on this list.

Your keys ride after the # in the address. That half of a URL is never transmitted, so browsers do not send it in the request, and it lands in no access log, no CDN log, and no Referer header on the way to any other site. That is a real difference from the ? half, and it is why the keys go there.

That is a smaller guarantee than privacy. The keys are inside the link text, so anyone holding the link can generate your codes just as the authenticator would. The page says this next to the Share button rather than further down, because it changes where you should keep the link. A private bookmark in your own browser is reasonable, a shared team document is a decision to make deliberately, and a public page will hand your codes to anyone who reads it.

Pasting the link into a chat app hands your codes to whoever reads that chat, and to whatever scans it. And if the link gets cut short in transit, which chat clients and spreadsheets both do, the page refuses it and says so, rather than opening a set that is missing the last two accounts without telling you.

Google Authenticator does not hand you a link per account the way most services do, which is why so few tools can read it. What it has is under Transfer accounts, then Export accounts, and it produces one or more QR codes. Scan one with any QR reader and you get a link starting otpauth-migration://. Paste that into the box at the top and every account inside it lands at once.

Two things worth knowing. If you have a lot of accounts the app splits them across several QR codes, so you need to paste each one, and the page tells you which of how many it just read. And if any of your entries are counter-based rather than time-based, they are left out and counted rather than shown, because a counter-based code cannot be worked out from a clock and displaying one would be making it up.

The same box also takes plain otpauth:// links, a whole block of them at once, or one secret key per line.

Export, under Settings, writes a text file holding one otpauth:// line per account. Drop it back on this page and they come back, and because that is the format every authenticator reads, so does anything else you might move to. The file that gets you out of here is the same file that gets you in.

It is a small file. Five accounts came to 665 bytes and a full page of thirty came to 3,035 bytes, so there is no reason to keep only one copy of it. The first few lines are comments naming the file and the date, which readers skip and people do not.

The file is not encrypted, and that is deliberate. You are most likely to need it on the day the device that knew your password stopped working. An encrypted file whose password went down with that device would leave you with nothing to restore from. The trade is that the file holds your secret keys in readable text, so store it the way you would store a spare front door key rather than on a shared drive.

Restoring never overwrites what is already on screen. Accounts are matched by their key, so importing the same backup twice adds nothing the second time.

Optional, and off unless you turn it on. Save on this device encrypts your accounts into this browser under a master password, so you can come back without pasting a link.

You can add a PIN for day to day unlocking. The PIN is a shortcut, never the lock itself: your accounts are encrypted under a key stretched from the master password, and the PIN just holds a second copy of that key. That is why a short PIN does not weaken anything. Ten wrong PIN entries switch the PIN off, and after that the master password is the only way in.

Three honest limits, because this is the part of the page where overselling would matter:

• Nobody can reset your master password. There is no account and no server here, so there is no support desk and no recovery email. If you forget it, the saved copy is gone. Keep a backup file or a link.
• The count of wrong PIN entries is stored beside the vault in this browser. It stops someone picking up your unlocked laptop and trying a few guesses. It does nothing about someone who has copied the file off the machine, because they are not using this page to try.
• It is one browser on one device. Clearing your browsing data clears it. It does not follow you to your phone. The link and the backup file are what move between machines.

A time-based code comes from two ingredients, the secret the service gave you and the clock. The current time is chopped into blocks of thirty seconds, almost always, and each block produces one code from the secret. Both ends run the identical sum, which is how a page with no connection to your bank can produce the number your bank is expecting.

That also explains the countdown. Nothing is being fetched when the code changes. The block simply rolled over and the same arithmetic produced the next answer. Most servers accept the block either side of the current one, so a code is usually good for about ninety seconds in practice even though it looks like thirty.

It means the accuracy of your clock matters. If this machine is more than a minute or so out, every code here will be refused and nothing on screen will look wrong. If that is happening, the TOTP Generator has a checker built for exactly that question. Paste the code that was rejected and it works out whether the cause was drift, and by how many seconds, or a digit count and hash that never matched in the first place.

Almost every service in the world uses six digits, thirty seconds and SHA-1, which is why those are the defaults and why the box that changes them is folded away.

A handful of services do something else, and RFC 6238 allows it. When they do, the difference is total rather than partial. An eight digit code is not a six digit code with two more numbers on the front, it is a different number entirely. So if a service told you it uses eight digits or SHA-256, set that here or nothing will ever match. If it did not tell you, it is six, thirty and SHA-1.

An otpauth:// link carries all three, which is the easiest way not to think about it. Paste the link and the settings come with it.

When a service turns on two-factor authentication it shows you a QR code, and usually a line of letters and numbers underneath, sometimes behind a link reading "can't scan the code" or "enter this key manually". That line of letters and numbers is your secret key, and it holds exactly the same information as the QR code beside it.

If you only have the QR code, any QR reader will give you the otpauth:// link inside it, and this page takes that link whole.

Keep in mind that a secret key is not recoverable. Services show it once, at setup, and after that they will only offer to reset it, which invalidates whatever is already holding it. Copy your link before you close the tab.

• Name accounts for the login, not the company. "work email" beats "Microsoft" when you have three Microsoft logins.
• Keep separate links for separate purposes. One for the accounts only you use, another for the shared ones. Once you have sent a link you cannot un-send it, so being able to send only the shared half is worth the extra bookmark.
• Read the red notice literally. "What is on screen has not been copied anywhere yet" is about this exact set, not a general state of affairs. It appears the moment you add or rename an account and it clears when you copy the link, export a file or save the vault, so if it is showing, something you have done since your last copy exists only in this browser.
• Fold the add box away and it stays folded. The choice is remembered on this device on its own, nowhere near your accounts, so it cannot be lost with them or carried into a share link.
• Check the clock first. When every code is refused rather than one, the clock is nearly always the answer, and no amount of re-copying will help.
• This does not replace your phone app for the accounts that matter most. A link in a bookmark is convenient, and a device in your pocket is a second factor in the sense the phrase was meant. Use this where the convenience is worth it and keep the app where it is not.