Privacy

Last updated 19 September 2026.

TOTP generation

One-time codes are computed in your browser. We do not operate a user account system or a server-side list of 2FA secrets.

Saved accounts (cookie)

If you check “Save this account”, 2fakey writes a first-party cookie named 2fakey_vault containing labels and Base32 secrets you added. The cookie stays on that browser (up to about one year) so you can generate codes again without pasting the secret. Anyone who can use that browser can generate those codes.

Cookies are sent to 2fakey.net with later visits. We do not read the vault on the server to display the homepage; the list is rendered with JavaScript. You can remove one account or all of them from the generator page, or clear site cookies in your browser.

Other local data

Light/dark theme is stored in localStorage (2fakey-theme).

Logs

Standard web server logs may include IP address, URL, and user agent. Do not put secrets in the query string.

Contact

Questions about this policy: see about.