Every change to this tool, dated. Security-relevant entries are marked. If something here is wrong or a fix broke something for you, write to hello@2fagen.com.
A key field that stops growing, and deeper guides in Vietnamese and Indonesian
- The key field no longer changes height. It previously grew downward as you typed or pasted, pushing the rest of the card around and leaving a long key wrapped across two lines. It is now one fixed-height row that uses the full width of the card; the text itself scales to fit, and only once it reaches a readable floor does the field scroll instead, with a soft fade marking the side that has more text. This replaces the growing field introduced on 9 September.
- Added a clear button to the key field, so a pasted key can be removed in one tap rather than a long select-and-delete.
- The Vietnamese and Indonesian guides are now full guides. Both gained sections on the difference between an OTP and a 2FA code, why SMS is the weakest second factor, how to choose an authenticator app based on how it handles backup, where to switch 2FA on in the accounts people in each market actually use, what backup codes are for, and the things most commonly misunderstood about 2FA.
- Each translation of the guide now links to the others in plain text, and every version ends with a short related-reading list. Previously each translation could be reached from exactly one page on the site, and Google had crawled two of them and declined to index either.
- Article pages now carry published and modified dates and breadcrumb structured data, and the sitemap carries a real
lastmodper URL in place of two fields search engines ignore. - Security: rewrote
robots.txt. A crawler obeys only the single most specific group that matches it, so the named AI-crawler groups — which listed an allow rule but no disallow rules — were not covered by the restrictions in the catch-all group. Every group now repeats them.
Traditional Chinese, and pages about how this works
- Added 繁體中文 at
/zh-hant/for Hong Kong and Taiwan. The existing Chinese page was Simplified, which is the wrong script for both. - Added this changelog, an about page, and a security page that states the threat model plainly — including when not to use this tool.
- Nine languages now, each with translated interface text and error messages rather than translated marketing copy over an English tool.
Thai and Indonesian
- Added ไทย at
/th/and Bahasa Indonesia at/id/, complete with localised FAQ, privacy section and error messages. - Fixed a CSS class collision that clipped the language switcher in the admin panel.
- Raised the contrast of subtitle text, which was failing WCAG AA at 2.6:1.
Six languages and a rewritten test suite
- Added Tiếng Việt, 简体中文, Português, Español and Русский, on subdirectories with full bidirectional
hreflang. - Language is offered through a picker and never forced by IP address, so every version stays reachable and indexable.
- Rewrote the test suite, which had been calling functions that no longer existed and therefore silently testing nothing. It now verifies all eighteen RFC 6238 Appendix B vectors, the input parser, and every Base32 key length.
Input handling fixes
- Keys of 9, 11, 14 or 17 characters previously threw an internal error instead of an explanatory message. Fixed, and every length from 4 to 40 is now covered by a test.
- Short but valid keys were being rejected outright. They now generate a code with a non-blocking note, because refusing them broke real keys.
- Long keys were visually truncated in the input box. The field now grows to fit the whole key.
- Fixed a caching rule that could have kept a stale copy of the page for up to a year.
A logo, and the tool takes the stage
- New mark: the countdown ring from the tool itself, wrapped around a bold numeral.
- Rebuilt the interface around the generator — larger card, click-anywhere-to-copy, automatic generation on paste, and the explanatory text moved below the fold where it belongs.
HTTPS, and the tool starts working
- Issued a certificate and moved the site to HTTPS. The Web Crypto API is unavailable in an insecure context, so before this the generator could not run at all.
- First public release: RFC 6238 TOTP generation, entirely client-side.
How releases work
Every release runs the RFC 6238 Appendix B test vectors first — all eighteen, across SHA-1, SHA-256 and SHA-512 — along with parser tests and a browser pass over every language. A release does not ship if any of those fail.
Asset URLs carry a content hash, so a fix reaches you on your next visit rather than waiting for a cache to expire.