Protect your setup key

Treat an authenticator secret like a credential.

Anyone with your setup key can generate the same codes. Do not put secrets in URLs, screenshots, shared files or support messages. This tool does not keep a vault. Use a trusted authenticator for everyday account management and keep recovery codes somewhere safe.

Use this tool on a trusted device and connection. Extensions, clipboard history or other software on the device may read data. Clear the secret when finished. TOTP codes can still be phished; use phishing-resistant authentication such as a passkey where supported.