This app stores your TOTP secret keys in a browser cookie:
JavaScript cookies cannot be HttpOnly — any XSS on this origin could steal your secrets.
Cookies are sent with requests to the same origin.
Anyone with access to this browser profile can extract the secrets.
Use only for personal/internal purposes. A safer production design would
use encrypted storage (PBKDF2 + AES-GCM), IndexedDB, WebAuthn or a
backend vault.
Add keys
One line = one key. Label and secret are separated by a space, tab,
comma, semicolon, colon, / or |.
A line without a separator is imported with no label.
TOTP Authenticator
RFC 6238 · HMAC-SHA1 · 6 digits · 30s step · 100% local, no server
Stored key data is corrupted and could not be read. You can reset it (this deletes
all saved keys).