Privacy policy

The short version: we cannot see your keys, we cannot lose them, and there is nothing about you to protect — because we never receive it.

What this site collects

Nothing. There are no accounts, no tracking cookies, no analytics, no form submissions, and no third-party tracking pixels. The site is statically generated HTML plus JavaScript that runs locally in your browser. The one thing this site stores on your device — the last key you used, in your browser’s local storage — is described below under Local storage, and cookies are covered under Cookies.

Cookies

2facounter.com does not set any cookies of its own, and nothing about your visit is profiled or recorded by this site. The tool’s “remember my last key” behavior uses your browser’s localStorage — a storage area that never leaves your device and is not sent to us — rather than cookies. More on storage in the Local storage section below.

Google advertising

There are no ads on the site today, and the tool works without any. This policy discloses in advance how advertising would work if it is ever introduced (for example, via Google AdSense): third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites; Google’s use of advertising cookies (such as the DoubleClick cookie) enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet; and you may opt out of personalized advertising at any time by visiting Google Ads Settings or www.aboutads.info. For Google’s own account of how it uses data when you use our partners’ sites, see How Google uses data when you use our partners’ sites or apps. Advertising cookies would never be used to read, receive, or transmit your 2FA secret keys — those are handled exclusively in the tool described above and are simply not in scope for anything beyond your own browser.

What never leaves your device

• Your Base32 / otpauth:// secret keys.
• Screenshots and images you drop in or paste for QR scanning.
• Your saved key (the last one you entered, stored only in your browser’s local storage).
• Generated TOTP codes and their timers.

If you use the camera-scan option, your browser asks permission before the tool can access the camera. The video stream is decoded on your device to read the QR code and is never recorded, stored, or transmitted; closing the scanner releases the camera.

You can verify all of this yourself: open your browser’s DevTools, watch the Network tab, and paste a key. Zero requests carry your data. Once the page is loaded you can disconnect from the internet entirely — decoding QR images, generating codes, and copying them all keep working offline.

Local storage

The most recent key you enter is kept in your browser’s localStorage under the key 2fac.key.v2 so the generator restores it on a page refresh. That data never leaves your device. Clearing the input field, clearing site data in your browser, or using the generator in a private window means nothing is stored at all.

There is no cloud sync and no export file: the tool intentionally has nothing to back up. Keep the original secret in an encrypted, password-manager vault — that is your master copy, and it contains your raw secrets.

Third-party requests

There are none. Fonts (display, text, and mono) and the QR-decoding library are all bundled at build time and served from this domain itself — loading 2facounter.com makes zero requests to any third-party CDN, analytics provider, or ad network. Your browser talks only to this site, and never sends any of your data. Once the page is loaded (or the app is installed), everything keeps working with the internet disconnected entirely.

Standard logs

Like every website on the internet, our hosting provider (or CDN) may process standard connection metadata such as request IP addresses and user agents for security and abuse prevention. That processing happens outside our control and is governed by the provider’s own practices, however briefly the provider retains it. No 2FA data is ever included, because no 2FA data is ever transmitted.

Children

The tool is a general-purpose utility and does not target children under 13. It is not designed to collect any personal information, and it has no mechanism that sends data to us — there is nothing server-side to hand over or delete.

Changes

If this policy changes meaningfully, including the domain, the change will be noted above. Public issue? Write to the contact page.