This page explains how the local TOTP generator handles authenticator setup keys, generated codes, URL shortcuts, browser processing, and advertising scripts.
The authenticator code calculation runs in your browser with the Web Crypto API. The app does not need an account, and it does not send your pasted Base32 secret or otpauth URI to a backend API to calculate the TOTP code.
The recommended shortcut format is the URL fragment form, such as #secret=YOUR_BASE32_SECRET, because fragments are not sent in the HTTP request. Path and query shortcuts still work for convenience, but those server-visible URLs are marked noindex.
Some pages include Google advertising and funding choices scripts. Those third-party scripts may process browser, network, and consent information for ads and compliance. The TOTP generator code does not intentionally send your setup key to those scripts.
The site is served through Cloudflare Workers. Cloudflare and browser infrastructure may process normal request metadata such as URL, IP address, user agent, timing, and security logs to deliver and protect the service.
This matrix summarizes what stays in the browser, what may be visible to infrastructure, and how to use the TOTP generator more safely.
| Area | Tool behavior |
|---|---|
| TOTP codes are generated locally | The authenticator code calculation runs in your browser with the Web Crypto API. The app does not need an account, and it does not send your pasted Base32 secret or otpauth URI to a backend API to calculate the TOTP code. |
| Setup keys and URL shortcuts | The recommended shortcut format is the URL fragment form, such as #secret=YOUR_BASE32_SECRET, because fragments are not sent in the HTTP request. Path and query shortcuts still work for convenience, but those server-visible URLs are marked noindex. |
| Advertising and third-party scripts | Some pages include Google advertising and funding choices scripts. Those third-party scripts may process browser, network, and consent information for ads and compliance. The TOTP generator code does not intentionally send your setup key to those scripts. |
| Server and hosting logs | The site is served through Cloudflare Workers. Cloudflare and browser infrastructure may process normal request metadata such as URL, IP address, user agent, timing, and security logs to deliver and protect the service. |
| Does the tool store my authenticator setup key? | There is no account database for storing your setup key. The current page state lives in your browser while you use it. For long-term storage, use a trusted authenticator app or password manager. |
The TOTP calculation runs locally in the browser. Avoid putting real secrets in path or query URLs; use the #secret= fragment shortcut when you need a URL shortcut.
Path and query values are visible to the server, logs, browser history, and shared links. They still work for convenience, but the page sends noindex signals so search engines should not index those URLs.
There is no account database for storing your setup key. The current page state lives in your browser while you use it. For long-term storage, use a trusted authenticator app or password manager.