Legal

Terms of Use

These terms explain what 2FA Keyring is, what you're responsible for when you use it, and the limits of what it promises. They're written to be read, so please take a few minutes to go through them.

Effective 16 October 2026 ยท Applies to 2fa-keyring.com and the 2FA Keyring app

Accepting these terms

By using the 2FA Keyring website or app, you agree to these terms and to the Privacy Policy. If you don't agree, please don't use them. In these terms, "we" and "us" refer to the 2FA Keyring project and its maintainer, and "you" refers to anyone using the website or app.

What 2FA Keyring is

2FA Keyring is a free authenticator that runs entirely in your web browser. It generates time-based one-time passwords (TOTP, RFC 6238) from setup keys you add, and stores those keys encrypted on your device. There are no accounts, and we don't operate any server that stores your data. How it works is described on the security page.

Your responsibilities

Because your keys exist only on your device, keeping access to them is in your hands. You're responsible for:

  • Your passphrase: choosing a strong passphrase and remembering it
  • Backups: exporting encrypted backups and keeping them somewhere safe
  • Recovery codes: keeping each service's recovery codes separately from this app, so you can sign in if you lose access to your vault
  • Your device: keeping your device, browser and extensions secure and up to date, and locking the vault when you step away
  • Your codes: checking each code before relying on it, including that your device's clock is set correctly

No recovery

We can't recover your passphrase, your keys or your vault.

We never have a copy of them. If you forget your passphrase, clear your browser's data, or lose your device without a backup, your keys can't be restored by us or anyone else. Use your services' recovery codes to regain access to your accounts.

Acceptable use

You may use 2FA Keyring only for accounts you own or are authorised to access, and only in ways that comply with the law and with the terms of the services you use it for. Don't use the website or app to gain unauthorised access to any account or system. Don't interfere with the website or its hosting, or attempt to distribute a modified copy of the app as if it were this one.

Availability and changes

2FA Keyring is provided free of charge. We may change, update or stop offering the website or app at any time, without notice. We don't guarantee it will always be available or work in every browser. Keep a current backup, and remember you can also run your own copy from the public source code (see the security page).

Open source

The source code is public at github.com/estuty/2FA-Keyring and is released under the MIT License. You may use, copy, modify and distribute it under that license's terms, provided the copyright notice and license text are kept. A modified copy you publish is your own service, not the official 2FA Keyring at 2fa-keyring.com, and these terms don't cover it. Third-party components keep their own licenses: the jsQR library (Apache License 2.0), and the Bricolage Grotesque and JetBrains Mono fonts (SIL Open Font License 1.1). Their license files are included with the code.

Other services and trademarks

2FA Keyring isn't affiliated with, endorsed by or sponsored by any service you use it with. Names such as GitHub, Google, Microsoft, AWS, Discord and Dropbox are trademarks of their owners and are mentioned only to describe compatibility. The website is hosted by Cloudflare and the source code by GitHub, whose own terms apply to their services.

No warranty

The website and app are provided "as is" and "as available", without warranties of any kind, express or implied. This includes warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, and uninterrupted or error-free operation, to the fullest extent permitted by law. We work to keep 2FA Keyring correct and secure, but we don't promise that it's free of defects or vulnerabilities, or that it will meet your needs.

Limitation of liability

To the fullest extent permitted by law, we're not liable for any indirect, incidental, special, consequential or punitive damages, or for any loss of data, access, accounts, profits or business, arising from or related to your use of, or inability to use, the website or app. This includes being locked out of an account because a passphrase was forgotten, a vault was deleted or a backup was lost. Where liability can't be excluded, it's limited to the amount you paid to use 2FA Keyring, which is zero.

Some jurisdictions don't allow certain warranties or liabilities to be excluded or limited. In those places, the exclusions and limits above apply only as far as the law allows, and nothing in these terms affects rights you have that can't be waived.

Governing law

These terms are governed by the laws of the United States, without regard to conflict-of-law rules. 2FA Keyring is used around the world. If you live outside the United States, you also keep any protections that the consumer laws of your country give you and that can't be waived by agreement, and nothing in these terms takes those away.

Before taking any formal step, please contact us first (see Contact) so we can try to resolve the issue informally.

Changes to these terms

We may update these terms from time to time. The new version will be published on this page with a new effective date, and every past version stays in the project's public history on GitHub. If you keep using 2FA Keyring after a change, you accept the updated terms.

Contact

For questions about these terms, open an issue on the project's GitHub page. Please never include setup keys, backups or other secrets in an issue. To report a security problem privately, use GitHub's private vulnerability reporting.