Privacy policy

The short version: we cannot see your keys, we cannot lose them, and there is nothing about you to protect — because we never receive it.

What this site collects

Nothing that identifies you or your keys. There are no accounts, no form submissions, and no ad tracking pixels. The site runs two measurement tools, both strictly separate from the 2FA tool:

• Cloudflare Web Analytics — a small, cookieless script that reports anonymous, aggregate performance data (page views, load times, approximate country) and stores nothing in your browser.
• Google Analytics, loaded through a Google Tag Manager container — used for aggregate traffic measurement, and only after you accept the analytics prompt on your first visit (see Cookies). Google Analytics sets first-party cookies (the _ga family) in your browser and processes standard device and browser data under Google’s privacy terms. You can opt out entirely with Google’s official opt-out add-on.

Neither tool receives anything you type — your keys and codes are handled entirely in the tool, locally. The site is statically generated HTML plus JavaScript that runs locally in your browser. The tool does not even write your 2FA keys to browser storage — they live only in the open page’s memory, as described below under Local storage. Cookies are covered under Cookies.

Cookies

2facounter.com does not set any cookies of its own. Google Analytics, loaded through Google Tag Manager, sets first-party analytics cookies (the _ga family): they store a random client identifier so repeat visits can be counted as one user, and they contain nothing you type, paste, scan, or generate. On your first visit we ask before enabling these analytics cookies — decline, and Google Analytics never loads at all; accept, and you can change your mind later via the "Cookie settings" link in the footer. Cloudflare Web Analytics is cookieless by design and stores nothing in your browser. Blocking or deleting analytics cookies does not affect the generator in any way. Your keys are never profiled or recorded: the tool deliberately has no “remember my last key” behavior — your keys exist only in the open page’s memory, never in localStorage and never in cookies. More in the Local storage section below.

Google advertising

There are no ads on the site today, and the tool works without any. This policy discloses in advance how advertising would work if it is ever introduced (for example, via Google AdSense): third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites; Google’s use of advertising cookies (such as the DoubleClick cookie) enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet; and you may opt out of personalized advertising at any time by visiting Google Ads Settings or www.aboutads.info. For Google’s own account of how it uses data when you use our partners’ sites, see How Google uses data when you use our partners’ sites or apps. Advertising cookies would never be used to read, receive, or transmit your 2FA secret keys — those are handled exclusively in the tool described above and are simply not in scope for anything beyond your own browser.

What never leaves your device

• Your Base32 / otpauth:// secret keys.
• Screenshots and images you drop in or paste for QR scanning.
• Anything you type into the generator — keys are held in the page’s memory only and are never written to browser storage.
• Generated TOTP codes and their timers.

If you use the camera-scan option, your browser asks permission before the tool can access the camera. The video stream is decoded on your device to read the QR code and is never recorded, stored, or transmitted; closing the scanner releases the camera.

You can verify all of this yourself: open your browser’s DevTools, watch the Network tab, and paste a key. Zero requests carry your data. Once the page is loaded you can disconnect from the internet entirely — decoding QR images, generating codes, and copying them all keep working offline.

Local storage

Nothing. The generator does not write your key, your codes, or your recent-keys list to localStorage, sessionStorage, cookies, or IndexedDB — they exist only in the open page’s memory, so refreshing or closing the page wipes them all. Keys previously saved under 2fac.key.v2 and 2fac.recent.v1 by older versions of the tool are erased from your browser’s storage the next time you visit.

There is no cloud sync and no export file: the tool intentionally has nothing to back up. Keep the original secret in an encrypted, password-manager vault — that is your master copy, and it contains your raw secrets.

Third-party requests

Two, by design. Fonts (display, text, and mono) and the QR-decoding library are all bundled at build time and served from this domain itself. The only exceptions are the two measurement tools above: Cloudflare Web Analytics — a small, deferred script from Cloudflare’s static.cloudflareinsights.com that reports anonymous, aggregate performance data, is cookieless, writes nothing to your browser, and is discarded by Cloudflare without storing IP addresses — and Google Tag Manager / Google Analytics, loaded from www.googletagmanager.com, which sets the first-party cookies described under Cookies. Everything else your browser talks to is this site only.

The 2FA tool itself remains fully local: nothing you type, paste, scan, or generate ever leaves your device. Once the page is loaded (or the app is installed), the tool keeps working with the internet disconnected entirely — the analytics beacon simply has nothing to report while you are offline and goes quiet.

Standard logs

Like every website on the internet, our hosting provider (or CDN) may process standard connection metadata such as request IP addresses and user agents for security and abuse prevention. That processing happens outside our control and is governed by the provider’s own practices, however briefly the provider retains it. No 2FA data is ever included, because no 2FA data is ever transmitted.

Children

The tool is a general-purpose utility and does not target children under 13. It is not designed to collect any personal information, and it has no mechanism that sends data to us — there is nothing server-side to hand over or delete.

Changes

If this policy changes meaningfully, including the domain, the change will be noted above. Public issue? Write to the contact page.