vault — browser-based 2FA

vault.

client-side TOTP — your secret never leaves this browser

otpauth:// URI or Base32 secret

Issuer (label)

Account

Digits

Period

Algo

No accounts yet. Paste a secret, drop a QR image, or scan one to begin.

Runs entirely in your browser via the Web Crypto API (RFC 6238 / RFC 4226). No requests, no cookies — your secret never leaves this device. Accounts are saved in your browser, so they're still here after a refresh. Want them gone? Just clear site data for this site and they're wiped.