From one setup key to a carefully managed authenticator

Path A: use a code immediately in guest mode

Open 2FA Live and obtain the actual setup key or otpauth TOTP URI from the account's genuine security settings. Paste one credential per line, then watch each valid entry appear with its current code and countdown. The browser calculates the code from the seed and the time window. The website you are accessing remains responsible for verifying it. Use Copy deliberately and paste only into the real website's verification field.

Guest values are temporary. Clear the entry before handing the computer to someone else, and expect the browser to discard them when you reload or leave the page. Invalid lines are reported individually so you can correct a spelling, padding, or URI-profile issue without changing a different account's valid credential. If the source site offers a QR instead of a text key, the generic TOTP QR capture flow is a separate way to transfer the same sensitive setup data into your active tab.

• Locate the original site's 2FA enrollment page.
• Copy the setup key or supported TOTP URI.
• Generate, read the countdown, and use the current code on that site.
• Clear guest input at the end of the session.

Path B: create and unlock a member Vault

Google sign-in establishes the identity of the member who is permitted to request encrypted Vault data from the server. It is not the cryptographic unlock step. The Vault creates its own encryption key and protects it through separate passphrase and recovery key slots. After local unlock, the browser can show authenticator labels, calculate codes, edit entries, and encrypt changes for synchronization with another member device.

Before relying on this path, save the recovery key somewhere distinct from your everyday device. The active implementation contains release gates for approving Argon2id parameters and real-browser key handling; descriptions of those controls do not substitute for verification that each target device has passed acceptance. A Google sign-in can be necessary for cloud data access even if you still know the Vault passphrase.

Import, synchronize, and resolve differences deliberately

You can add a supported TOTP entry from a manual key, a TOTP URI, or a local QR image. Google Authenticator migration uses its export/transfer QR flow: collect every QR fragment from the same export and review the parsed entries before selecting what to import. The browser encrypts selected entries before the sync API is given their ciphertext. HOTP entries, unrecognized fields, and unvalidated profiles receive visible errors or warnings rather than a silent conversion.

A second device signs into the same member account, receives encrypted envelopes, and unlocks them locally using matching Vault material. If two devices edit the same item while out of sync, the revision/conflict workflow may require a decision. Do not repeatedly import or overwrite entries just to silence an unresolved sync warning; doing so could create an additional credential copy or conceal which version the original service accepts.

Prepare for a lost phone before you need the answer

An encrypted backup file and the matching recovery key offer a separate recovery route. If you still have a usable Google session but forgot the Vault passphrase, a matching recovery slot may allow local unlocking. If you have lost access to Google as well, a previously downloaded compatible encrypted backup can be opened locally with its corresponding key; it cannot automatically restore the Google account itself.

The absence of every secret copy, recovery key, and external service's recovery codes may leave an account unrecoverable. For high-value sites, store those site's official backup codes separately and understand its account recovery policy. Neither 2FASync's member login nor the code generator can reconstruct an authenticator secret that nobody has retained.

Is the guest generator the same as an encrypted Vault?

No. Guest mode creates temporary codes in the current tab. The member Vault encrypts an intentionally saved collection under separately managed key material.

Does an import remove codes from Google Authenticator?

Do not assume that. Export QR import creates another copy of the selected supported credentials; review the old device and original account enrollment before removing any authenticator.