Question 1

What is Secret2OTP and how does it work?

Accepted Answer

Secret2OTP is an offline, browser-based TOTP (Time-based One-Time Password) generator for two-factor authentication (2FA). It implements the RFC 6238 standard to generate cryptographically secure codes every 30 seconds. All processing happens locally in your browser. No servers, no accounts, no data collection, and no network transmission of secrets.

Question 2

Why should I use Secret2OTP instead of traditional authenticator apps?

Accepted Answer

Secret2OTP requires no app installation and works instantly in any modern browser. It is privacy-first by design: secrets are processed locally, never synced, never uploaded, and never stored on servers. It is especially useful as a lightweight or emergency backup alongside authenticator apps, or for users who prefer full control over their secrets.

Question 3

Is Secret2OTP secure?

Accepted Answer

Yes. Secret2OTP is secure by design. TOTP secrets never leave your device and are never transmitted to any server. Codes are generated locally using standard cryptographic algorithms defined in RFC 6238. Each code is valid only for a short time window, significantly reducing the risk of interception or reuse.

Question 4

How can I add accounts to Secret2OTP?

Accepted Answer

You can add accounts using four local-only methods: (1) Scan a QR code using your device camera, (2) Manually enter or paste a secret key, (3) Bulk import via a plain TXT file, or (4) Paste multiple secrets at once. All inputs are processed locally in your browser and never sent elsewhere.

Question 5

What is the correct TXT format for bulk importing accounts?

Accepted Answer

Each line in the TXT file represents one account. Supported formats include: 'Name,SecretKey', 'SecretKey' only, or 'email:password:SecretKey' (password is ignored). Files must be UTF-8 encoded and use valid Base32 secrets. CSV or spreadsheet formats are not supported.

Question 6

Which services are compatible with Secret2OTP?

Accepted Answer

Secret2OTP works with any service that supports standard TOTP (RFC 6238). This includes thousands of platforms that offer two-factor authentication or authenticator-based login. If a service mentions 'TOTP', '2FA', or 'authenticator app', it is compatible. Secret2OTP is not affiliated with any specific provider.

Question 7

How should I back up my TOTP secrets?

Accepted Answer

Because Secret2OTP does not store or sync data, backups are your responsibility. Recommended options include saving service-provided recovery codes, securely storing secret keys in encrypted password managers, or keeping encrypted offline backups. This design ensures maximum privacy and user control.

Question 8

Can I install Secret2OTP and use it offline?

Accepted Answer

Yes. Secret2OTP is a Progressive Web App (PWA) and can be installed on desktop or mobile devices. Once installed, it works fully offline and generates TOTP codes without any internet connection.

Question 9

Which browsers and devices are supported?

Accepted Answer

Secret2OTP works on all modern browsers including Chrome, Firefox, Safari, Edge, Brave, and Opera. It supports Windows, macOS, Linux, Android, and iOS (Safari). A modern browser with JavaScript enabled is required.

Question 10

Does Secret2OTP collect any data?

Accepted Answer

No. Secret2OTP collects zero personal data. There is no tracking, logging, analytics of user secrets, or account information. The application is designed so that we cannot access your data even if we wanted to.

Question 11

How does Secret2OTP compare to authenticator apps?

Accepted Answer

Secret2OTP runs entirely in the browser and does not sync or store data. Authenticator apps often provide cloud backup or device syncing, which may trade convenience for reduced privacy. Many security-conscious users use Secret2OTP alongside an authenticator app for redundancy.

Question 12

Is scanning QR codes safe?

Accepted Answer

Yes. QR code scanning is handled locally by your browser. The QR image is processed on your device only and never uploaded. Camera access is limited to decoding the QR code and does not transmit images or video streams externally.

Question 13

Can I use Secret2OTP on mobile devices?

Accepted Answer

Yes. Secret2OTP works on smartphones and tablets via mobile browsers. For best experience, install it as a PWA to your home screen. Mobile usage provides the same security and offline guarantees as desktop.

Question 14

Can I export accounts from Secret2OTP?

Accepted Answer

Secret2OTP intentionally avoids automated export to minimize accidental data leaks. Users retain full control by manually backing up secret keys using secure methods such as encrypted password managers or offline storage.

Question 15

Why do TOTP codes change every 30 seconds?

Accepted Answer

TOTP codes rotate every 30 seconds as defined by RFC 6238. This short validity window prevents replay attacks, brute-force attempts, and reuse of intercepted codes while maintaining usability.

Question 16

What should I do if I lose my device?

Accepted Answer

If you lose your device, use service-provided recovery codes or account recovery processes to regain access. If you previously backed up your secret keys securely, you can re-import them into Secret2OTP on a new device.

Frequently Asked Questions

Still have questions?