Security
2sv.top is built so we don't need, and can't get, your setup keys.
When you just get a code
The code is computed in your browser. The setup key isn't sent anywhere and is gone when you close the page.
When you save to the vault
Your password never leaves your device. Your browser turns it into a key and locks each code with that key before uploading. The server only holds locked data, including service names.
When you send a link
Each link has its own key in the last part of the link (after the #). Browsers never send that part to the server, so only someone with the full link can read the code.
Good to know
Anyone who can open a share link can also get the setup key. Turning a link off only stops future opens. If you forget your password and lose your recovery code, nobody can open the vault, including us.
Technical details
Argon2id (64 MiB, 3 passes) and HKDF-SHA256 derive keys from your password; AES-256-GCM locks data; TOTP codes follow RFC 6238. The site loads no third-party scripts, fonts or analytics.