The six-digit codes a login asks for, computed here from the secret the service showed you when you turned on two-step verification. The same arithmetic an authenticator app does, in this tab, with no account behind it and nothing synced anywhere. Lock the accounts with a passphrase to keep the secrets encrypted in this browser, and export an encrypted file as the backup.
The accounts on this device are encrypted with your passphrase.
Time this page is using: . A code depends on the clock; if this is more than a few seconds out, set the device's clock and the codes will be right.
When a service shows you a QR code, it also offers the key as text, or the address behind the code starts with otpauth://. Paste either.
Or the key by hand:
It is the standard, exactly. RFC 6238 TOTP over HMAC through the browser's WebCrypto, 6 or 8 digits, 30 or 60 seconds, SHA-1, SHA-256 or SHA-512. The code here matches the code any authenticator app shows for the same secret at the same second.
The secrets live in this browser. Like everything on this site, in this browser's storage on this device. Set a passphrase and they are stored encrypted (AES-256-GCM, key from the passphrase by PBKDF2-SHA256 at 600,000 rounds) and decrypted only while the page is open.
The backup is a file you keep. Export writes one encrypted .obscura file; restore reads one. Put it wherever you keep backups. There is no sync and no account, so there is nothing to be locked out of and nothing to be breached.
The clock is yours to get right. A code is a function of the secret and the time. This page cannot check the time against anything without a network; it shows the time it is using, and if the device is a minute out, the codes will be wrong until it is set.
This is not a second device. A code generated on the same machine you log in from is a second factor only against someone who has your password and not your machine. That is most attacks, and it is still less than a separate phone.
It does the same arithmetic and gives the same codes. What it does not give you is a second device: if this browser's storage is lost or wiped and you have no backup file, the codes are gone. Export a backup, and keep the recovery codes each service gave you.
Not here; a camera in a web page is a permission too many for a tool about secrets. Every service also shows the key as text (usually behind 'can't scan?'), and QRSHIELD on this site reads the address out of a QR code image without the camera.
Almost always the clock: check the time this page shows against a reliable one. Next, the secret was typed with a 0 or a 1 (base32 has neither; use O and I). Then the digits or period, which a few services set to 8 or 60.
No. Open the network tab in your browser's developer tools; nothing goes out. The page works with the network off.