What this is
2FA Gen turns a Base32 secret into the same six-digit code your authenticator app would show, without installing anything. It exists because that job is genuinely useful and almost every tool that does it asks you to trust a server with the one piece of information that must never reach one.
This one does not have a server to send it to. The page is static files. The code generation runs in your browser through the Web Crypto API. You can confirm that by watching the network tab, or by pulling the plug and watching it keep working. The security page covers the threat model properly, including the cases where you should not use this tool at all.
Who runs it
2FA Gen is operated by an independent maker rather than a company — one person paying for a small server, with no investors, no analytics contract, and nobody to answer to about engagement metrics. That is the reason the privacy stance can be absolute instead of aspirational: there is no growth target that a tracking script would help hit.
Reach the operator at hello@2fagen.com. Security reports go to security@2fagen.com and are covered on the security page.
How it is paid for
Hosting and a domain cost money, so it is fair to say where the money comes from.
The site occasionally shows a single self-hosted banner for a related service. It is one static image served from this domain — not an ad network, not a third-party script, not a tracker, and not personalised, because the page holds no data about you to personalise against. It cannot see what you do on the page, and it is the reason there is no analytics script here: a plain image needs none.
What this site will never do: sell data it does not collect, add a third-party advertising SDK, gate the tool behind an account, or introduce a paid tier that removes a privacy protection the free version had.
What it deliberately does not do
- No accounts. Nothing to sign up for, so nothing to breach.
- No saved keys. Convenient, and it would mean storing exactly the secret this tool exists to protect. The trade is not worth it.
- No QR scanning. Camera access on a page handling secrets is a permission worth not asking for. Paste the text secret instead — every service that shows a QR code also shows the text.
- No analytics. Visitor numbers come from the server's own request logs, which record no more than any web server already does and involve no code running in your browser.
Standards and correctness
The generator implements RFC 6238 (TOTP) on top of RFC 4226 (HOTP) — the same specifications Google Authenticator, Microsoft Authenticator, Authy and every other compliant app follow. That is why a code from this page matches a code from your phone.
Correctness is verified against all eighteen official test vectors in RFC 6238 Appendix B, covering SHA-1, SHA-256 and SHA-512 across every published timestamp, plus every valid Base32 key length. Those tests run before each release.
Languages
The tool is available in nine languages, each translated rather than machine-generated: English, Tiếng Việt, ไทย, Bahasa Indonesia, 繁體中文, 简体中文, Português, Español and Русский. Error messages and interface text are localised too, not only the marketing copy.
If a translation reads awkwardly to a native speaker, that is a bug worth reporting. Write to hello@2fagen.com and it will be fixed.
Open questions we are happy to answer
Is it really free? Yes, with no usage limit and no account.
Will it stay up? It is cheap to run — static files on a small server — so there is no burn rate forcing a change of model. If it ever shuts down, the changelog will say so in advance rather than the page simply disappearing.
Can I use it at work? Yes, and the security page is the honest answer to whether you should for any specific account.