This app stores your TOTP secret keys in a browser cookie:
JavaScript cookies cannot be HttpOnly — any XSS on this origin could steal your secrets.
Cookies are sent with requests to the same origin.
Anyone with access to this browser profile can extract the secrets.
Use only for personal/internal purposes. A safer production design would
use encrypted storage (PBKDF2 + AES-GCM), IndexedDB, WebAuthn or a
backend vault.
Add keys
One line = one key. Accepts the seller format
login|password|secret (last | segment is the
secret, first becomes the label), space-grouped secrets
(BK5V TVQ7 D2RB ...), or just label secret
separated by a space, tab, comma, semicolon, colon or /.
Case, spaces and = padding don't matter.
Edit key
TOTP Authenticator
RFC 6238 · HMAC-SHA1 · 6 digits · 30s step · 100% local, no server
Stored key data is corrupted and could not be read. You can reset it (this deletes
all saved keys).