Codes without an account
Paste a secret on the homepage and get live codes instantly. Nothing is stored, nothing is sent, and a reload wipes it all.
Features
Every capability below ships today and is covered by automated tests. Nothing on this page is a roadmap promise.
Paste a secret on the homepage and get live codes instantly. Nothing is stored, nothing is sent, and a reload wipes it all.
Secrets are encrypted in your browser before they reach the server. A full server and database compromise reveals ciphertext only.
TOTP, HOTP, and Steam Guard, with SHA1, SHA256, and SHA512 algorithms, 6 to 8 digits, custom periods, and counters per key.
Paste a Base32 secret, paste an otpauth link, scan a QR code with the camera, upload a QR image, or import a whole Google Authenticator export.
Organize entries into folders you can rename and reorder. Each entry carries a description plus custom text and secret fields.
Export the vault to a passphrase-encrypted file and import it into any account. Backups stay readable even if this service disappears.
Code generation is pure client-side math. Generate codes in airplane mode, and read your vault from its encrypted local cache.
Every vault change syncs through a documented per-item API with conflict handling, the same API future browser extensions and mobile apps reuse.
Your master password derives the only key. There is no reset link, no hint storage, and no support path that can decrypt anything, because nothing decryptable is ever stored.
No analytics, no ads, no external fonts or scripts. The strict Content-Security-Policy blocks outbound connections by construction.
100 folders and 100 entries with every code type, forever, no card required. Paid plans only lift the limits.
The guest tool needs no account. When you want storage, the vault is one signup away, and the free tier covers most personal use.