Recommended fragment format
Use https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECRET for temporary shortcuts. The fragment after # stays in the browser and is not sent in the HTTP request to the server.
2FA secret URL shortcuts
This guide explains how URL shortcuts work in this local TOTP generator. You can preload a Base32 setup key or otpauth URI from a fragment, path, or query parameter, while keeping the generated code logic local in the browser.
Path shortcut format
A path such as https://2fa.chatgpt.org.uk/YOUR_BASE32_SECRET can also preload the generator. Because path values are visible to the server, logs, browser history, and shared links, secret path URLs are marked noindex and no-store.
Query parameter format
Query shortcuts such as https://2fa.chatgpt.org.uk/?secret=YOUR_BASE32_SECRET, ?key=, ?code=, ?otp=, and ?totp= are supported. They are convenient for internal tools, but they are server-visible and should not be shared with real secrets.
otpauth URI shortcut
You can put an encoded otpauth://totp/ URI in the fragment or paste it into the input. The tool reads supported parameters such as secret, issuer, algorithm, digits, and period.
Display versus calculation
The input keeps the original pasted or URL-provided text visible. Internally, the generator normalizes spaces, hyphens, and Base32 padding before calculating the TOTP code.
Indexing and privacy boundary
Clean guide and tool pages are indexable. Server-visible secret URLs are not: they return noindex, nofollow, noarchive, no-store, and a canonical link back to the clean home page.
Standards and references
FAQ
What is the safest URL format for a 2FA setup key?
Use the fragment format: https://2fa.chatgpt.org.uk/#secret=YOUR_BASE32_SECRET. Fragments are handled by the browser and are not sent in the HTTP request.
Do path and query secret URLs still work?
Yes. Path and query shortcuts still preload the generator, but they are visible to servers and logs, so real secrets should use the #secret= fragment format whenever possible.
Will Google index a URL that contains my secret?
Server-visible secret URLs are marked noindex and no-store, and their canonical URL points to the clean home page. You should still avoid sharing real secrets in public links.
Can I use this with multiple generators?
A URL shortcut fills the first generator by default. After the page opens, you can add more generators manually for additional 2FA or MFA setup keys.