About

Why this exists

Two-factor authentication is the single best upgrade you can make to account security. But most people meet it inside a phone app — and phones get lost, sold, dunked in water, and drained to 1% at exactly the wrong moment. Losing the only device that carries your authenticator is one of the fastest ways to lock yourself out of your own account.

2FA COUNTER (2facounter.com) is the fix: the exact RFC 6238 TOTP algorithms your phone app runs, implemented in JavaScript, running on whatever device you actually have in front of you. Paste a setup key once, get live codes for as long as you need them.

Zero-knowledge, not zero-responsibility

Because every calculation happens in your browser with the Web Crypto API, there is no server-side database of keys — nothing that could be sold, subpoenaed, or breached. The trade-off is real responsibility on your side: back up your secrets in an encrypted password manager before anything else, and always keep the service’s one-time recovery codes offline. This tool is a convenience and an emergency access route — the recovery codes are the airbag.

Principles

• No accounts, ever. A login form on a security tool is an attack surface, not a feature.
• No telemetry. We don’t want to know how many keys you have — that’s the point.
• Verifiability. The network tab is your receipt: keys never cross the wire.
• Works offline. Installed as a PWA, it never needs us again after the first visit.

How we write and review guides

Our step-by-step guides are fact-checked against each service's own documentation, and every guide carries a visible review date. Corrections are welcome — guides@2facounter.com. See the full editorial & fact-checking methodology.

Contact

Questions, bug reports, or a service where your TOTP parameters don’t match? Use the contact page.