Which TOTP algorithm does AltF Authenticator use?

HMAC-SHA-1 over an 8-byte counter derived from Unix time divided by a 30-second period, truncated to 6 digits. Those are the RFC 6238 defaults, so codes match Google Authenticator, Authy, 1Password and any other standard TOTP client using the same secret.

Is my 2FA secret stored anywhere?

No. It lives in the page's React state for as long as the tab is open. It is not written to localStorage or a cookie, and no request carrying it is ever made. Reloading the page clears it and you must paste it again.

Should this replace my authenticator app?

No. Because nothing is stored, this is a temporary utility for checking or recovering a code, not a place to keep the only copy of an account credential. Keep your secrets in a dedicated authenticator app or a password manager.

Loading page

All products

WorkingPrivate local TOTP

AltF Authenticator

AltF Authenticator generates 6-digit TOTP verification codes from a Base32 secret using HMAC-SHA-1 over a 30-second time step - the default construction described in RFC 6238 and the same one used by Google Authenticator and Authy. The secret stays in the browser tab's memory: it is never written to storage, never sent to a server and is lost when you close the tab, so this is a verification utility rather than a replacement for an authenticator app.

Secrets are held in memory only and never sent to a server

Local TOTP generator

The secret stays in this tab's memory and is never persisted or transmitted. Clear it when finished.

Safety note: use this as a temporary verification utility, not as the only copy of an account credential.

Base32 secret

Current code

------

Refreshes in 30s

Temporary backup codes

Generated locally; they are not linked to an account.