About 2faco
A privacy-first security resource — free tools, honest guides, and everything running locally in your browser.
What We Build
2faco was created to provide simple, secure, and privacy-focused security tools directly in your browser. No accounts required. Privacy-first tools, free forever. Every tool — from password generation to JWT decoding — runs entirely client-side.
Alongside the tools, we publish practical guides on two-factor authentication, data breaches, and account security. Our goal is to make good security habits accessible to everyone, not just developers.
Who We Are
2faco is a small, independent project run by security-minded people who were tired of two problems: security tools that quietly collect your data, and security advice that reads like it was written for engineers.
We started with a single time-based one-time password (TOTP) generator that ran entirely in the browser. The response was clear — people wanted tools they could trust without installing anything. Today the site has grown into a full security resource: nineteen browser-based tools and a growing library of guides covering two-factor authentication, password managers, passkeys, and account recovery.
We are not affiliated with Google, Authy, Microsoft, or any other vendor. That independence is deliberate: it lets us write honest comparisons and recommend what actually works, not what pays the best commission.
Our Principles
Privacy First
Secret keys, passwords, and tokens never leave your device. Everything runs in your browser.
Free Forever
All tools are free with no paywalls. We monetise through affiliate links and display ads — clearly labelled.
Accurate
Our guides are written carefully and updated when platforms change. Corrections are always welcome.
No Bloat
No heavy frameworks, no trackers. Fast-loading pages that work on any connection.
Our Mission
We believe everyone deserves tools that respect their privacy. 2faco generates time-based one-time passwords (TOTP) locally, without storing or transmitting secret keys. The same principle applies to every tool on the site.
Our long-term goal is to build the most trusted, most useful, and most privacy-respecting security resource on the web.
What's Next
We're continuously expanding 2faco based on what our readers need most. Current priorities:
- More platform guides. We add 2–4 new setup guides per month based on reader requests and platform changes.
- Passkey coverage. As WebAuthn/FIDO2 adoption grows, we're building guides for passkey setup, recovery, and cross-device sync.
- Developer tools. New utilities for JWT, HMAC, bcrypt, and other cryptographic primitives used in auth systems.
- Accessibility improvements. Ongoing work toward full WCAG 2.1 AA compliance across the site.
Have an idea for a tool or guide? Let us know — we prioritise requests that come from real problems our readers face.
How Our Tools Work
Every tool on 2faco follows the same architecture:
- Client-side only. All processing happens in your browser using JavaScript. Secret keys, passwords, and tokens are never sent to a server — there is no server to send them to.
- Works offline. Once a page has loaded, most tools keep working without an internet connection, because everything is computed locally.
- No accounts, no tracking. You never need to register, and we do not build user profiles. We use a minimal analytics script only to understand which articles are useful.
- Auditable. The tools are based on open, published standards such as RFC 6238 (TOTP), RFC 4226 (HOTP), and the OWASP password guidelines.
This "zero-knowledge" approach is what makes browser-based tools a genuinely private alternative to mobile authenticator apps. You can even verify it yourself: load any tool, disconnect from the internet, and it still works.
Editorial Standards
Our guides are written by people who have actually recovered hacked accounts, lost phones with 2FA enabled, and walked through platform security settings page by page. Every article is fact-checked against the vendor's current documentation before publication.
We commit to:
- Accuracy first. If a platform changes its settings flow, we update the affected guide — and we date-stamp the change.
- Honest comparisons. We test what we recommend. When we mention an affiliate product, it is clearly labelled and we only link to products we would use ourselves.
- Corrections welcome. Spotted an error? Contact us and we will fix it — and we will credit the correction in the article's revision history.
Frequently Asked Questions
Is 2faco really free?
Yes. All tools and articles are free, with no paywalls and no premium tier. The site is supported by clearly labelled display advertising and affiliate links, which do not affect how tools work or what we recommend.
Do you store my secret keys?
No. Your secret keys never leave your browser. There is no backend database, no account system, and nothing is logged.
Can I use the tools commercially?
Yes, the tools are free for personal and commercial use. If you plan to embed them at scale or build a product on top of them, check our terms first and contact us.
Why is 2fa in the name?
Two-factor authentication is the single highest-impact security control most people can enable, and it is the heart of what we build. "2faco" stands for two-factor authentication, done honestly.