RFC 6238 · AES-256-GCM · Server-side only

Secure TOTP Authenticator

Generate secure two-factor authentication codes and manage your authenticator accounts in one place.

RFC 6238 compliant codes generated from your encrypted secrets — never stored in plain text.

Standard 6-digit codes with SHA-1 support, ready the moment you open your dashboard.

Codes refresh automatically every 30 seconds with a live countdown so you are never caught out.

Add as many authenticator accounts as you need — social media, email, finance and more.

Every TOTP secret is encrypted with AES-256-GCM before it is stored on our servers.

A responsive, touch-friendly dashboard that works beautifully from 320px phones to 4K screens.

Security First

Your passwords are securely hashed and your TOTP secrets are encrypted before being stored.

Passwords are hashed with bcrypt before being stored — never saved as plain text.
TOTP secrets are encrypted with AES-256-GCM using a server-only encryption key.
Your secret key is only decrypted on the server, inside a single request, when generating a code.
Session cookies are HTTP-only and Secure, and never exposed to client-side JavaScript.
You can only ever access your own accounts — each request is authorized server-side.
Rate limiting protects the authentication endpoints from brute-force attacks.

Create a free account and start generating two-factor authentication codes in seconds.