What is 2fa?

This project is a two-factor authentication key manager you publish as your own Cloudflare Worker, so the whole app runs serverlessly on the free Workers tier instead of a VPS. It generates TOTP and HOTP codes locally in the browser, and keys can be added by scanning a QR code with the camera, uploading, pasting or dragging a screenshot, or typing a Base32 secret with custom digits, period and algorithm. Bulk import works with exports from Google Authenticator migration QR codes, Aegis, 2FAS, Bitwarden, LastPass, andOTP and Ente Auth, and bulk export writes TXT, JSON, CSV, HTML or a scannable Google Authenticator migration QR code. Secrets are stored in a Workers KV namespace and, once the ENCRYPTION_KEY secret is set, encrypted with AES-GCM 256; automatic backups are kept (100 by default) and can be pushed to WebDAV, S3-compatible storage, OneDrive or Google Drive. A companion browser extension for Chrome, Edge and Firefox reads and autofills codes, and the web app installs as a PWA with offline add/edit/import that syncs later. Deployment is either the Cloudflare deploy button (upgrades run through the Sync Upstream workflow) or a wrangler command line path; there is no Docker image. Only a single management password protects the instance, and OTP can also be exposed through unauthenticated public /otp/ URLs, which is a deliberate but security-relevant design.

Should you self-host 2fa?

2fa scores 48/100 on selfhost.directory (how scoring works) and ranks #25 of 40 in Authentication. It has 458 GitHub stars.

It shipped 14 stable releases in the past year. The latest, v1.13.1, came out on 19 October 2026. New versions land roughly every 3 days.

Setup is easy: most people get it running in one sitting. It is MIT-licensed and written mostly in JavaScript.

Its closest alternative on selfhost.directory is keycloak (86/100, 37 571 stars). It scores higher overall, so compare the two before you pick. See 2fa vs keycloak side by side.

Features

Automatic backup and restore
Browser extension autofill
Bulk export
Bulk Import
Customisable session lifetime
Encrypted secret storageOptional: without the key data is stored in plain text in KV.
HOTP support
Multi-language UI
Public OTP API
QR code scanning and image recognition
Remote backup sync
Search and grouped key list
TOTP code generation
Utilities toolbox