Guides

Host your own copy

2FA Keyring is plain static files with no build step. Running your own copy means you don't depend on this website, or on whoever deploys it.

For people comfortable with web hosting

Why self-host

Your browser runs whatever code a website serves. On 2fa-keyring.com that's the code in the public repository, deployed automatically. A copy you host yourself only changes when you update it, after you've reviewed the changes.

Run it on your computer

  1. Download the repository from GitHub (Code → Download ZIP) and unzip it, or clone it with git.
  2. In that folder, start a local web server. With Node.js installed, npx wrangler dev serves it exactly as Cloudflare does, including the security headers. Python's python3 -m http.server 8000 also works.
  3. Open the address it prints, such as http://localhost:8787/app/. Browsers allow encryption on localhost without HTTPS.

Opening the HTML files directly from disk (file://) won't work, because the pages load their scripts and styles from the site root.

Host it on the web

  • Cloudflare Workers: the repository includes wrangler.jsonc. Run npx wrangler deploy and attach your own domain in the Cloudflare dashboard.
  • Any static host: upload the files as they are, serve them over HTTPS, and configure the headers below.

Security headers

Each page already declares a Content Security Policy in a meta tag. Send these as HTTP headers too; _headers in the repository has the exact values:

  • Content-Security-Policy, including frame-ancestors 'none', which meta tags can't set
  • Strict-Transport-Security, X-Content-Type-Options: nosniff and X-Frame-Options: DENY
  • Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy

Don't serve the repository's own files (README, configuration). On Cloudflare, .assetsignore handles this.

Choose the address carefully

A browser keeps storage per origin (scheme, host and port), and every page on an origin can read it. Use a domain or subdomain that serves nothing else, such as 2fa.example.com. Avoid shared hosts like username.github.io, where all of an account's project sites share one origin, and which can't send security headers.

Vaults don't move between addresses automatically. To switch from 2fa-keyring.com to your copy, download a backup here and restore it there.

Updating

Watch the repository's releases and changelog. Review changes before deploying them, especially in app/ and assets/. The vault format is designed to stay compatible, but keep a backup before updating.