2FA

2FA shows TOTP and HOTP codes in a PWA backed by a Worker in your own Cloudflare account. Secrets come in by QR code or from Google Authenticator, Aegis, 2FAS or Bitwarden exports. With ENCRYPTION_KEY set, the Worker encrypts them with AES-GCM.

Besides QR code scans, secrets can be added from a pasted or uploaded screenshot, an image dragged onto the page, or a Base32 key typed in by hand. Bulk import also reads LastPass Authenticator, andOTP and Ente Auth exports, and export writes TXT, JSON, CSV, HTML or Google migration QR codes. The PWA works offline, has light and dark themes, and comes in 15 languages. ENCRYPTION_KEY also covers automatic backups and the stored credentials for remote backup targets. The Worker stores the admin password as a salted PBKDF2-SHA256 hash and keeps the session in an HttpOnly cookie. Backups run after each change and in a daily cron check, and the app keeps the latest 100 by default. Remote copies can go to WebDAV, S3-compatible buckets such as R2, OneDrive or Google Drive. Browser extensions for Chrome, Edge and Firefox read codes from your instance and fill them on websites you approve. A public OTP API also generates codes from a URL. Account data lives in KV, and the Worker routes reads and writes through a SQLite-backed Durable Object so that edits from several devices do not overwrite each other. The button creates an independent repository instead of a fork, and upgrades run in place through its Sync Upstream GitHub Actions workflow. A demo instance runs at 2fa-dev.wzf.workers.dev.

Built for: Individuals and small teams who want a self-hosted TOTP manager they control, reachable from any device

What you can use it for

• Keep 2FA codes in one self-hosted place for phone and desktop
• Move secrets out of Google Authenticator, Aegis or 2FAS
• Back up 2FA secrets to WebDAV, S3, OneDrive or Google Drive
• Fill TOTP codes on websites with the browser extension

Deploy

• One-click · main path

  Branch main

  Deploy to Cloudflare

• CLI

  Branch main

  npm install
  npm run deploy

  Copy

The button creates the KV namespace and the Durable Object. Set the admin password on first visit, and add ENCRYPTION_KEY as a secret if you can keep its value somewhere safe. OneDrive and Google Drive backups need their own OAuth app setup.

What it needs to run

• KV namespacesSECRETS_KV

Good to know

Losing ENCRYPTION_KEY makes encrypted data and backups unrecoverable. WebDAV backups fail with services proxied through Cloudflare, such as Nutstore, because of 520 loop errors. The main README is in Chinese, and only the README has an English translation (docs/en/README.md); the deployment and cloud-drive guides are Chinese only. A single admin password protects the instance. The Deploy to Cloudflare button does not copy GitHub workflows, so add the Sync Upstream file before the first update.

Cost on Cloudflare

Where this comes from

• Repositoryhttps://github.com/wuzf/2fa
• App websitehttps://2fa-dev.wzf.workers.dev
• Documentationhttps://github.com/wuzf/2fa/blob/main/docs/en/README.md

An alternative to Authy, Google Authenticator, Microsoft Authenticator.