Every change to this tool, dated. Security-relevant entries are marked. If something here is wrong or a fix broke something for you, write to hello@2fagen.com.
Traditional Chinese, and pages about how this works
- Added 繁體中文 at
/zh-hant/for Hong Kong and Taiwan. The existing Chinese page was Simplified, which is the wrong script for both. - Added this changelog, an about page, and a security page that states the threat model plainly — including when not to use this tool.
- Nine languages now, each with translated interface text and error messages rather than translated marketing copy over an English tool.
Thai and Indonesian
- Added ไทย at
/th/and Bahasa Indonesia at/id/, complete with localised FAQ, privacy section and error messages. - Fixed a CSS class collision that clipped the language switcher in the admin panel.
- Raised the contrast of subtitle text, which was failing WCAG AA at 2.6:1.
Six languages and a rewritten test suite
- Added Tiếng Việt, 简体中文, Português, Español and Русский, on subdirectories with full bidirectional
hreflang. - Language is offered through a picker and never forced by IP address, so every version stays reachable and indexable.
- Rewrote the test suite, which had been calling functions that no longer existed and therefore silently testing nothing. It now verifies all eighteen RFC 6238 Appendix B vectors, the input parser, and every Base32 key length.
Input handling fixes
- Keys of 9, 11, 14 or 17 characters previously threw an internal error instead of an explanatory message. Fixed, and every length from 4 to 40 is now covered by a test.
- Short but valid keys were being rejected outright. They now generate a code with a non-blocking note, because refusing them broke real keys.
- Long keys were visually truncated in the input box. The field now grows to fit the whole key.
- Fixed a caching rule that could have kept a stale copy of the page for up to a year.
A logo, and the tool takes the stage
- New mark: the countdown ring from the tool itself, wrapped around a bold numeral.
- Rebuilt the interface around the generator — larger card, click-anywhere-to-copy, automatic generation on paste, and the explanatory text moved below the fold where it belongs.
HTTPS, and the tool starts working
- Issued a certificate and moved the site to HTTPS. The Web Crypto API is unavailable in an insecure context, so before this the generator could not run at all.
- First public release: RFC 6238 TOTP generation, entirely client-side.
How releases work
Every release runs the RFC 6238 Appendix B test vectors first — all eighteen, across SHA-1, SHA-256 and SHA-512 — along with parser tests and a browser pass over every language. A release does not ship if any of those fail.
Asset URLs carry a content hash, so a fix reaches you on your next visit rather than waiting for a cache to expire.