An authenticator you can understand before you trust

Start with the setup key supplied by your account

When a website asks you to enable an authenticator, it normally displays a QR code and offers a setup key. That key is the long-lived secret shared between the website and your authenticator. The six-digit number you later type at login is only a short-lived result calculated from that secret. In 2FA Live, you can enter a valid Base32 setup key or a TOTP setup URI to calculate the current number in this browser. You do not have to register a 2FASync member account just to use this guest tool.

Check that you obtained the setup key from the real account settings page, over a connection you trust. Never paste your account password, original website recovery codes, Google password, or a secret from somebody else's account into the generator. If the website has already enrolled another authenticator, adding the same secret to a new tool creates another working copy of that factor; decide whether that extra copy is appropriate before proceeding.

See why the number changes even when you do nothing

Time-based one-time passwords, usually called TOTP codes, are calculated locally from a shared secret, a cryptographic algorithm, and the current time window. Many services use six digits and a 30-second window, but supported TOTP setup URIs can describe other profiles. A countdown shows when the current window ends, and the next code appears as time advances. Your website performs its own verification with its own record of the secret; 2FASync is the code generator, not that website's login or verification server.

Copy the number only into the account sign-in page you intended to visit. Near the end of a time window, a perfectly calculated code may expire before the website accepts it. If that happens, wait for the next window instead of repeatedly submitting the old number. If codes are rejected consistently, first check the device clock and account setup rather than assuming the site or your account has been compromised.

Guest mode is deliberately temporary

Guest input is processed within the active browser page. You can place several keys or TOTP URIs on separate lines and receive separate code cards; a malformed line produces its own explanation without disabling valid lines. The current implementation sets a bounded number of input lines, avoids a server endpoint that takes plaintext seeds to calculate OTPs, and clears guest entries when the page is reloaded or left. Clear the entry yourself when you finish, particularly if another person may use the computer.

Temporary does not mean invulnerable. An extension with broad permissions, malware, a compromised browser, screen recording, another person looking over your shoulder, and a clipboard history tool can expose material used while the page is open. Even when the application clears its JavaScript references, it cannot promise complete physical memory erasure. Use a device and browser you trust, and do not assume a shared kiosk is a safe place to handle a long-lived setup key.

Decide whether you need an encrypted member Vault

An occasional verification code may be all you need. If you need a longer-lived collection of authenticator entries, 2FASync also has a member Vault architecture: Google sign-in identifies the cloud account, while a separate Vault passphrase or recovery key is needed to unlock item encryption within your browser. Signed-in members can work with searchable authenticator entries, encrypted key slots, and ciphertext synchronization. A Google account session never becomes a substitute for possession of your Vault decryption material.

Browser-side encryption is designed to keep the secret-bearing items encrypted when they reach normal server synchronization. The server still needs operational data such as account and session identity, device records, encrypted envelopes, revision numbers, and bounded security events. Encryption does not eliminate the need for a safe device, and an unlocked Vault can be exposed by malicious code running with the same privileges as the page. Some key and device behaviors remain subject to release acceptance gates; treat the described flow as the implementation's design, not a claim of universal device certification.

Transfer from Google Authenticator by reviewing an export QR

If your existing codes live in Google Authenticator, moving them into a different product requires a deliberate transfer. In Google Authenticator, use the account transfer or export flow and select the entries you want to move. The export can display one QR or several pages of QR codes. In an unlocked 2FASync Vault, the import flow can scan a camera image or supported local image file, assemble the complete set, show the interpreted accounts, and let you choose which supported TOTP entries to include.

This is manual export/import, not access to Google's private Authenticator cloud sync and not a Google OAuth connection to your codes. The export QR carries reusable authentication secrets, so it deserves the same protection as a password. Do not send QR screenshots to support conversations or a third-party scanner. Check warnings, duplicates, account labels, and unsupported entries before import; an incomplete batch or a counter-based HOTP item is not safely repaired by guessing.

Keep a recovery path before the original device disappears

Encryption makes recovery a responsibility you should plan while your account is still accessible. A member Vault can use separately saved recovery material to unlock a matching encrypted key slot after Google sign-in. Encrypted backup is a distinct, user-initiated file workflow: with the matching recovery key, a supported local backup can be opened in the browser without first signing into the original Google account. Keep the file and the key in separate, secure locations; if either goes missing, the other may be useless.

A Vault recovery key is not one of the backup codes generated by the websites where you enabled 2FA. If you lose every authenticator copy and have no usable encrypted Vault backup, you may need to use each website's own recovery process. Neither 2FASync nor Google login can recreate an unknown TOTP seed merely from an email address. After changing Vault recovery material, verify which key is required by older encrypted backups; key rotation does not erase copies of files someone saved earlier.

Know what sync, trusted devices, and revocation can actually do

Encrypted sync is about moving ciphertext and revisions between signed-in member devices, then decrypting after local unlock. It is not a stream of ready-made OTP numbers from a central server. When two devices change the same entry, the safe behavior is to preserve and reconcile the conflict instead of discarding one version without warning. Deletion may be represented by a synchronized tombstone so a device that was offline can learn that an entry was removed.

A trusted-device path aims to reduce repeated Vault passphrase entry by using a browser-controlled local key, subject to real-browser approval. Non-extractable Web Crypto storage should not be mistaken for proof of a dedicated hardware security chip. Revoking a device or session can stop future server-authorized use of its associated access path. It cannot retroactively recall data, screenshots, backups, or credentials that someone copied while that device was already compromised or unlocked.

An authenticator is one layer of account defense

A TOTP gives you another factor alongside your account password, which can substantially change an attacker's task. But a real-time phishing site can relay both password and the current OTP. Compromised devices and malicious browser extensions can also undermine a software authenticator. When your service supports passkeys or hardware security keys, evaluate those phishing-resistant methods. Also enable account recovery safeguards, verify unfamiliar login notifications, and remove authenticator enrollments you no longer need.

Read the security and privacy explanations before relying on a long-lived encrypted Vault, especially if you share devices or work across locations. The source contains controls for local locking, secret handling, recent authentication, and backup verification, but final production readiness depends on independent runtime and browser evidence. A clear understanding of those limits gives you a better way to decide whether the temporary guest generator or the persistent encrypted Vault suits a particular account.

Choose the next useful action

If you have a current TOTP setup key from a service you trust, begin with 2FA Live and watch the first code change at the next time window. If you are migrating from Google Authenticator, read the import guide first so you know how to protect the export QR and handle multiple QR pages. If your goal is long-term storage, read the backup and recovery guides before creating a Vault and make a separate plan for what happens if Google access or a device is lost.

If a verification code fails, check the dedicated troubleshooting guide for clock mismatch, old time windows, wrong profiles, duplicate labels, and import errors. For a practical security decision, review the threat model, client-side encryption explanation, and privacy data map. Nothing in these guides requires uploading a real authenticator secret to request help; when describing an issue, use redacted error classes and non-sensitive facts instead.

Can I generate an authenticator code without signing in?

Yes. Guest 2FA Live calculates supported TOTP codes within the active browser tab from a setup key or TOTP URI. Guest entries are not saved as a member Vault and are cleared on reload or page departure.

Does signing in with Google unlock my encrypted Vault?

No. Google sign-in identifies the member cloud account. Unlocking the Vault requires your separate Vault passphrase, matching recovery key, or an approved locally configured device key.

Can I move Google Authenticator codes automatically?

2FASync handles a manually created transfer/export QR from Google Authenticator. It does not connect to Google Authenticator's proprietary cloud sync or import your Google account's codes without your export.

Will a TOTP protect me from every phishing attempt?

No. An attacker can relay a currently valid OTP through a fake website. Consider phishing-resistant passkeys or security keys where the original service offers them.